aws-cfn-stacksets-enter-target-account

cloudformation:CreateStackInstances / UpdateStackSet in the admin account deploys to target accounts, executing as the StackSet execution role there - a cross-account foothold.

derived aws emits CanEnterAccount

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'admin_role': None} CrossAccountTrust {'target_account': None} {'principal': None} CanPassIdentity {'admin_role': None}

where

node_type(?admin_role) == Role # AWSCloudFormationStackSetAdministrationRole or equivalent node_type(?target_account) == Account ?admin_role is a StackSets administration role (has sts:AssumeRole on the target execution role) ?principal has EFFECTIVE cloudformation:CreateStackInstances OR cloudformation:UpdateStackSet on the stack set

emit

source type	`Identity`
target type	`Account`
source	`?principal`
target	`?target_account`
permissions	`cloudformation:CreateStackInstances` `cloudformation:UpdateStackSet` `iam:PassRole`
conditions	`trust_relationship` `iam_permission`
state logic	ACTIVE when (a) ?principal has EFFECTIVE cloudformation:CreateStackInstances or UpdateStackSet on the stack set, (b) CanPassIdentity to ?admin_role is ACTIVE, AND (c) the CrossAccountTrust between ?admin_role and ?target_account is confirmed (AWSCloudFormationStackSetExecutionRole trust policy grants AssumeRole to ?admin_role in the admin account). CONDITIONAL(trust_relationship) when the execution-role trust in the target account is not confirmed. BLOCKED if SCP in the target org denies cloudformation:CreateStackInstances or sts:AssumeRole for the admin role.

Narrative

{principal.name} can deploy StackSet instances into target account {target_account.name} via CloudFormation StackSets (cloudformation:CreateStackInstances + AWSCloudFormationStackSetAdministrationRole assumes AWSCloudFormationStackSetExecutionRole there), gaining a foothold in {target_account.name} with the execution role's permissions.

Raw rule rules/derived/aws/cloudformation.yaml

id: aws-cfn-stacksets-enter-target-account
emits: CanEnterAccount
description: "cloudformation:CreateStackInstances / UpdateStackSet in the admin account deploys to target\
  \ accounts, executing as the StackSet execution role there \u2014 a cross-account foothold."
match:
- - admin_role: null
  - CrossAccountTrust
  - target_account: null
- - principal: null
  - CanPassIdentity
  - admin_role: null
where:
- 'node_type(?admin_role) == Role  # AWSCloudFormationStackSetAdministrationRole or equivalent'
- node_type(?target_account) == Account
- ?admin_role is a StackSets administration role (has sts:AssumeRole on the target execution role)
- ?principal has EFFECTIVE cloudformation:CreateStackInstances OR cloudformation:UpdateStackSet on the
  stack set
emit:
  source_type: Identity
  target_type: Account
  source: ?principal
  target: ?target_account
  permissions:
  - cloudformation:CreateStackInstances
  - cloudformation:UpdateStackSet
  - iam:PassRole
  conditions:
  - trust_relationship
  - iam_permission
  state_logic: ACTIVE when (a) ?principal has EFFECTIVE cloudformation:CreateStackInstances or UpdateStackSet
    on the stack set, (b) CanPassIdentity to ?admin_role is ACTIVE, AND (c) the CrossAccountTrust between
    ?admin_role and ?target_account is confirmed (AWSCloudFormationStackSetExecutionRole trust policy
    grants AssumeRole to ?admin_role in the admin account). CONDITIONAL(trust_relationship) when the execution-role
    trust in the target account is not confirmed. BLOCKED if SCP in the target org denies cloudformation:CreateStackInstances
    or sts:AssumeRole for the admin role.
  confidence: 0.9
  derived_from:
  - ?admin_role CrossAccountTrust ?target_account
  - ?principal CanPassIdentity ?admin_role
  - cloudformation:CreateStackInstances EFFECTIVE on stack set
  false_positive_note: "The default AWSCloudFormationStackSetExecutionRole policy is AdministratorAccess,\
    \ but organizations may scope it down. Do NOT assume AdministratorAccess \u2014 resolve the actual\
    \ execution role policy before asserting a full account takeover. Service-MANAGED StackSets (Organizations-integrated)\
    \ use a different SLR mechanism and require separate treatment (aws-cfn-stacksets-org-enter); this\
    \ rule covers only SELF-MANAGED StackSets where explicit administration + execution roles are present.\
    \ CanEnterAccount is cited from can-control.yaml enter-account-via-assume \u2014 do not re-derive\
    \ the full escalation chain."
  narrative: '{principal.name} can deploy StackSet instances into target account {target_account.name}
    via CloudFormation StackSets (cloudformation:CreateStackInstances + AWSCloudFormationStackSetAdministrationRole
    assumes AWSCloudFormationStackSetExecutionRole there), gaining a foothold in {target_account.name}
    with the execution role''s permissions.'