aws-bedrock-knowledge-base-role-swap

Swap a Bedrock Knowledge Base's service role via UpdateKnowledgeBase+PassRole to access data sources as an attacker-chosen role.

derived aws emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`?role`
permissions	`bedrock:UpdateKnowledgeBase` `iam:PassRole`
conditions	`iam_permission` `role_compatibility`
state logic	if ?role trust policy or iam:PassedToService is unknown/unresolved: POTENTIAL(role_compatibility); else: ACTIVE — the Knowledge Base immediately accesses data sources as the new role.

source type

Identity

target type

Identity

source

?principal

target

?role

permissions

bedrock:UpdateKnowledgeBase iam:PassRole

conditions

iam_permission role_compatibility

state logic

if ?role trust policy or iam:PassedToService is unknown/unresolved: POTENTIAL(role_compatibility); else: ACTIVE — the Knowledge Base immediately accesses data sources as the new role.

Narrative

{principal.name} can update Bedrock Knowledge Base {kb.name} to use a service role (bedrock:UpdateKnowledgeBase + iam:PassRole to bedrock.amazonaws.com); the KB immediately accesses its data sources and vector store as {role.name}, giving {principal.name} effective execution as {role.name}.

Raw rule rules/derived/aws/bedrock.yaml

id: aws-bedrock-knowledge-base-role-swap
emits: CanExecuteAs
description: Swap a Bedrock Knowledge Base's service role via UpdateKnowledgeBase+PassRole to access data
  sources as an attacker-chosen role.
match:
- - principal: null
  - CanModifyConfiguration
  - kb: null
- - principal: null
  - CanPassIdentity
  - role: null
where:
- node_type(?kb) == AnalyticsService
- ?kb.provider_type == 'AWS::Bedrock::KnowledgeBase'
- ?role trust policy allows bedrock.amazonaws.com (or is unknown -> POTENTIAL)
- iam:PassRole for ?role permits iam:PassedToService bedrock.amazonaws.com (or is unconditioned)
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?role
  permissions:
  - bedrock:UpdateKnowledgeBase
  - iam:PassRole
  conditions:
  - iam_permission
  - role_compatibility
  state_logic: "if ?role trust policy or iam:PassedToService is unknown/unresolved:\n  POTENTIAL(role_compatibility);\n\
    else:\n  ACTIVE \u2014 the Knowledge Base immediately accesses data sources as the new role."
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - <CanModifyConfiguration edge_id for ?principal -> ?kb>
  - <CanPassIdentity edge_id for ?principal -> ?role>
  false_positive_note: "Honor iam:PassedToService: a role passable only to lambda.amazonaws.com or ec2.amazonaws.com\
    \ does NOT yield a Bedrock KB role \u2014 downgrade to POTENTIAL(role_compatibility) when PassedToService\
    \ is absent or scoped to an incompatible service. The KB role trust policy must allow bedrock.amazonaws.com.\
    \ An SCP denying bedrock:UpdateKnowledgeBase or iam:PassRole at the effective scope makes this BLOCKED.\
    \ This rule duplicates execute-as-via-config-identity-swap in can-execute-as.yaml for Bedrock Knowledge\
    \ Bases; deduplication is automatic on (CanExecuteAs, source, target, scope)."
  narrative: '{principal.name} can update Bedrock Knowledge Base {kb.name} to use a service role (bedrock:UpdateKnowledgeBase
    + iam:PassRole to bedrock.amazonaws.com); the KB immediately accesses its data sources and vector
    store as {role.name}, giving {principal.name} effective execution as {role.name}.'