aws-codedeploy-create-group-as-service-role
Create a new CodeDeploy deployment group with any passable role as the service role, creating a workload bound to a chosen identity.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?principal has EFFECTIVE codedeploy:CreateDeploymentGroup
?role trust policy allows codedeploy.amazonaws.com (or regional endpoint)
iam:PassRole for ?role permits iam:PassedToService including codedeploy.amazonaws.com (or unconditioned)
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | ?principal |
| target | ?role |
| permissions | codedeploy:CreateDeploymentGroup iam:PassRole |
| conditions | iam_permission role_compatibility |
| state logic | ACTIVE when codedeploy:CreateDeploymentGroup and iam:PassRole for codedeploy.amazonaws.com are both confirmed as effective AND the target role's trust policy allows codedeploy.amazonaws.com. POTENTIAL(role_compatibility) when the role's trust policy is unknown. CONDITIONAL(iam_permission) when either permission is not yet confirmed. BLOCKED if an SCP or permission boundary denies codedeploy:CreateDeploymentGroup or iam:PassRole at this scope. |
Narrative
{principal.name} can create a new CodeDeploy deployment group (codedeploy:CreateDeploymentGroup) and bind {role.name} as the service role (iam:PassRole for codedeploy.amazonaws.com), creating a workload that executes as {role.name}.
Raw rule rules/derived/aws/codedeploy.yaml
id: aws-codedeploy-create-group-as-service-role
emits: CanCreateWorkloadAs
description: Create a new CodeDeploy deployment group with any passable role as the service role, creating
a workload bound to a chosen identity.
match:
- - principal: null
- CanPassIdentity
- role: null
where:
- ?principal has EFFECTIVE codedeploy:CreateDeploymentGroup
- ?role trust policy allows codedeploy.amazonaws.com (or regional endpoint)
- iam:PassRole for ?role permits iam:PassedToService including codedeploy.amazonaws.com (or unconditioned)
emit:
source_type: Identity
target_type: Identity
source: ?principal
target: ?role
permissions:
- codedeploy:CreateDeploymentGroup
- iam:PassRole
conditions:
- iam_permission
- role_compatibility
state_logic: ACTIVE when codedeploy:CreateDeploymentGroup and iam:PassRole for codedeploy.amazonaws.com
are both confirmed as effective AND the target role's trust policy allows codedeploy.amazonaws.com.
POTENTIAL(role_compatibility) when the role's trust policy is unknown. CONDITIONAL(iam_permission)
when either permission is not yet confirmed. BLOCKED if an SCP or permission boundary denies codedeploy:CreateDeploymentGroup
or iam:PassRole at this scope.
confidence: 0.9
derived_from:
- ?principal CanPassIdentity ?role
false_positive_note: "Honor iam:PassedToService \u2014 a role passable only to ec2 or ecs-tasks cannot\
\ be the CodeDeploy service role \u2014 downgrade to POTENTIAL when PassedToService does not include\
\ codedeploy.amazonaws.com. The role must also trust codedeploy.amazonaws.com (or the specific regional\
\ endpoint); without that trust, the group creation fails \u2014 mark CONDITIONAL when trust is unconfirmed.\
\ Only emit when the role is compatible with CodeDeploy orchestration; a role with only narrow EC2-describe\
\ permissions may not be a meaningful escalation, but the workload creation itself is the CanCreateWorkloadAs\
\ capability."
narrative: '{principal.name} can create a new CodeDeploy deployment group (codedeploy:CreateDeploymentGroup)
and bind {role.name} as the service role (iam:PassRole for codedeploy.amazonaws.com), creating a workload
that executes as {role.name}.'