aws-cognito-identity-pool-auth-role-mapping
match (record)
{
"api_source": "cognito-identity:GetIdentityPoolRoles",
"field": "Roles.authenticated",
"resource_type": "AWS::Cognito::IdentityPool"
}
emit
| source type | FederatedIdentity |
|---|---|
| target type | Role |
| source | <FederatedIdentity node (pool-authenticated users)> |
| target | <IAM Role from Roles.authenticated ARN> |
| permissions | cognito-identity:GetId cognito-identity:GetCredentialsForIdentity |
| state logic | ACTIVE — this edge represents a collected role-mapping fact (inventory). |
Narrative
Authenticated users of Identity Pool {pool.name} map to IAM role {role.name} (GetIdentityPoolRoles.Roles.authenticated).
Raw rule rules/explicit/aws-cognito.yaml
id: aws-cognito-identity-pool-auth-role-mapping
emits: ExternalIdentityMapsTo
applies_to:
- aws
match_record:
resource_type: AWS::Cognito::IdentityPool
api_source: cognito-identity:GetIdentityPoolRoles
field: Roles.authenticated
emit:
source_type: FederatedIdentity
target_type: Role
source: <FederatedIdentity node (pool-authenticated users)>
target: <IAM Role from Roles.authenticated ARN>
permissions:
- cognito-identity:GetId
- cognito-identity:GetCredentialsForIdentity
evidence_field: Roles.authenticated
state_logic: "ACTIVE \u2014 this edge represents a collected role-mapping fact (inventory)."
confidence: 0.99
derived_from:
- cognito-identity:GetIdentityPoolRoles (AWS Service Authorization Reference)
condition_note: Records the trust condition breadth from the role's trust policy (cognito-identity:amr
and cognito-identity:aud conditions); BROAD if amr is absent or only 'authenticated'; PINNED if amr
specifies a particular provider.
false_positive_note: This edge is a structural fact (role mapping configuration). Its exploitability
depends on the trust condition breadth (recorded in condition_note). Confirm the role's trust policy
condition (amr/aud) to determine if this path is BROAD (ACTIVE) or PINNED (CONDITIONAL). The federation-chains.yaml
rules consume this edge and emit CanFederateAs with state based on trust condition breadth.
narrative: Authenticated users of Identity Pool {pool.name} map to IAM role {role.name} (GetIdentityPoolRoles.Roles.authenticated).