aws-cfn-create-stack-workload-as

cloudformation:CreateStack + iam:PassRole(serviceRole to cloudformation.amazonaws.com): create a new stack bound to a chosen privileged service role and run arbitrary template code as it.

derived aws emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanPassIdentity {'role': None}

where

?principal has EFFECTIVE cloudformation:CreateStack (resource scope covers new stacks) ?role.trust_policy allows cloudformation.amazonaws.com as a trusted service iam:PassRole for ?role permits iam:PassedToService == cloudformation.amazonaws.com (or unconditioned)

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`?role`
permissions	`iam:PassRole` `cloudformation:CreateStack`
conditions	`role_compatibility` `iam_permission`
state logic	ACTIVE when (a) cloudformation:CreateStack is in EFFECTIVE policy for new stacks, (b) iam:PassRole for ?role is granted with iam:PassedToService including cloudformation.amazonaws.com or is unconditioned, AND (c) ?role.trust_policy allows cloudformation.amazonaws.com. POTENTIAL(role_compatibility) when ?role trust policy does not yet include cloudformation.amazonaws.com — CreateStack will fail because CloudFormation cannot assume the role. BLOCKED if SCP or permission boundary denies cloudformation:CreateStack or iam:PassRole in scope.

Narrative

{principal.name} can create a CloudFormation stack bound to {role.name} (cloudformation:CreateStack + iam:PassRole to cloudformation.amazonaws.com), then run arbitrary template resources as {role.name}. can-execute-as rolls this into CanExecuteAs({principal.name} -> {role.name}).

Raw rule rules/derived/aws/cloudformation.yaml

id: aws-cfn-create-stack-workload-as
emits: CanCreateWorkloadAs
description: 'cloudformation:CreateStack + iam:PassRole(serviceRole to cloudformation.amazonaws.com):
  create a new stack bound to a chosen privileged service role and run arbitrary template code as it.'
match:
- - principal: null
  - CanPassIdentity
  - role: null
where:
- ?principal has EFFECTIVE cloudformation:CreateStack (resource scope covers new stacks)
- ?role.trust_policy allows cloudformation.amazonaws.com as a trusted service
- iam:PassRole for ?role permits iam:PassedToService == cloudformation.amazonaws.com (or unconditioned)
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?role
  permissions:
  - iam:PassRole
  - cloudformation:CreateStack
  conditions:
  - role_compatibility
  - iam_permission
  state_logic: "ACTIVE when (a) cloudformation:CreateStack is in EFFECTIVE policy for new stacks, (b)\
    \ iam:PassRole for ?role is granted with iam:PassedToService including cloudformation.amazonaws.com\
    \ or is unconditioned, AND (c) ?role.trust_policy allows cloudformation.amazonaws.com. POTENTIAL(role_compatibility)\
    \ when ?role trust policy does not yet include cloudformation.amazonaws.com \u2014 CreateStack will\
    \ fail because CloudFormation cannot assume the role. BLOCKED if SCP or permission boundary denies\
    \ cloudformation:CreateStack or iam:PassRole in scope."
  confidence: 0.95
  derived_from:
  - ?principal CanPassIdentity ?role
  - cloudformation:CreateStack EFFECTIVE on new-stack scope
  false_positive_note: "Honor iam:PassedToService: a role passable only to ec2.amazonaws.com, lambda.amazonaws.com,\
    \ etc., does NOT qualify here. The role MUST trust cloudformation.amazonaws.com or CreateStack will\
    \ return an IAM validation error. Downgrade to POTENTIAL(role_compatibility) when trust policy is\
    \ ambiguous. can-execute-as.yaml execute-as-via-new-workload rolls CanCreateWorkloadAs into CanExecuteAs\
    \ \u2014 cite, do not re-derive CanExecuteAs here."
  narrative: '{principal.name} can create a CloudFormation stack bound to {role.name} (cloudformation:CreateStack
    + iam:PassRole to cloudformation.amazonaws.com), then run arbitrary template resources as {role.name}.
    can-execute-as rolls this into CanExecuteAs({principal.name} -> {role.name}).'