rage.fail

aws-beanstalk-pass-role

derived aws emits CanPassIdentity

match (effective permission)

{ "action": "iam:PassRole", "resource_type": "AWS::IAM::Role" }

where

role trust allows ec2.amazonaws.com OR elasticbeanstalk.amazonaws.com iam:PassedToService condition (if present) includes ec2.amazonaws.com / elasticbeanstalk.amazonaws.com

emit

source type	`Identity`
source	`<principal>`
target	`<IAM role passable to Beanstalk/EC2>`
permissions	`iam:PassRole`
conditions	`role_compatibility` `condition_expression`

Narrative

{principal.name} can pass {role.name} to Elastic Beanstalk/EC2 (iam:PassRole).

Raw rule rules/derived/aws/beanstalk.yaml

id: aws-beanstalk-pass-role
emits: CanPassIdentity
match_effective_permission:
  action: iam:PassRole
  resource_type: AWS::IAM::Role
where:
- role trust allows ec2.amazonaws.com OR elasticbeanstalk.amazonaws.com
- iam:PassedToService condition (if present) includes ec2.amazonaws.com / elasticbeanstalk.amazonaws.com
emit:
  source_type: Identity
  source: <principal>
  target: <IAM role passable to Beanstalk/EC2>
  permissions:
  - iam:PassRole
  conditions:
  - role_compatibility
  - condition_expression
  false_positive_note: 'PassRole alone is not execution. Honor iam:PassedToService: a role passable only
    to another service (e.g. lambda) yields no Beanstalk execution. Pair with a Create/UpdateEnvironment
    or CreateApplicationVersion capability.'
  narrative: '{principal.name} can pass {role.name} to Elastic Beanstalk/EC2 (iam:PassRole).'