rage.fail

aws-batch-pass-job-role

derived aws emits CanPassIdentity

match (effective permission)

{ "action": "iam:PassRole", "resource_type": "AWS::IAM::Role" }

where

principal has batch:RegisterJobDefinition PassedToService condition (if any) includes ecs-tasks.amazonaws.com (job/execution role) or batch.amazonaws.com (service role)

emit

source type	`Identity`
source	`<principal>`
target	`<jobRoleArn / executionRoleArn passable in scope>`
permissions	`iam:PassRole` `batch:RegisterJobDefinition`
conditions	`iam_permission` `condition_expression` `role_compatibility`

Narrative

{principal.name} can pass {role.name} as a Batch job/execution role (iam:PassRole + batch:RegisterJobDefinition).

Raw rule rules/derived/aws/batch.yaml

id: aws-batch-pass-job-role
emits: CanPassIdentity
match_effective_permission:
  action: iam:PassRole
  resource_type: AWS::IAM::Role
where:
- principal has batch:RegisterJobDefinition
- PassedToService condition (if any) includes ecs-tasks.amazonaws.com (job/execution role) or batch.amazonaws.com
  (service role)
emit:
  source_type: Identity
  source: <principal>
  target: <jobRoleArn / executionRoleArn passable in scope>
  permissions:
  - iam:PassRole
  - batch:RegisterJobDefinition
  conditions:
  - iam_permission
  - condition_expression
  - role_compatibility
  false_positive_note: 'iam:PassRole scoped by iam:PassedToService or ARN: a role passable only to ec2.amazonaws.com
    does NOT become a Batch task role. Honor the condition.'
  narrative: '{principal.name} can pass {role.name} as a Batch job/execution role (iam:PassRole + batch:RegisterJobDefinition).'