rage.fail

aws-batch-register-job-definition-code

derived aws emits CanModifyCode

match (effective permission)

{ "action": "batch:RegisterJobDefinition", "resource_type": "AWS::Batch::JobDefinition" }

emit

source type	`Identity`
source	`<principal>`
target	`<job definition (new revision)>`
permissions	`batch:RegisterJobDefinition`
conditions	`iam_permission` `condition_expression`

Narrative

{principal.name} can register a Batch job definition with an attacker-chosen image and command (batch:RegisterJobDefinition).

Raw rule rules/derived/aws/batch.yaml

id: aws-batch-register-job-definition-code
emits: CanModifyCode
match_effective_permission:
  action: batch:RegisterJobDefinition
  resource_type: AWS::Batch::JobDefinition
emit:
  source_type: Identity
  source: <principal>
  target: <job definition (new revision)>
  permissions:
  - batch:RegisterJobDefinition
  conditions:
  - iam_permission
  - condition_expression
  false_positive_note: batch:Image / batch:Privileged / batch:User condition keys may restrict the image,
    privilege, or user; honor them before claiming arbitrary code.
  narrative: '{principal.name} can register a Batch job definition with an attacker-chosen image and command
    (batch:RegisterJobDefinition).'