aws-cognito-identity-pool-rules-role-mapping

id: aws-cognito-identity-pool-rules-role-mapping
emits: ExternalIdentityMapsTo
applies_to:
- aws
match_record:
  resource_type: AWS::Cognito::IdentityPool
  api_source: cognito-identity:GetIdentityPoolRoles
  field: RoleMappings[*].RulesConfiguration.Rules[*].RoleARN
match_condition: RoleMappings[*].Type == Rules
emit:
  source_type: FederatedIdentity
  target_type: Role
  source: <FederatedIdentity node (pool-authenticated users whose token satisfies the claim rule)>
  target: <IAM Role ARN from RulesConfiguration.Rules[*].RoleARN>
  permissions:
  - cognito-identity:GetId
  - cognito-identity:GetCredentialsForIdentity
  evidence_field: RoleMappings[*].RulesConfiguration.Rules[*]
  state_logic: "ACTIVE \u2014 this edge represents a collected role-mapping fact (inventory)."
  confidence: 0.99
  derived_from:
  - cognito-identity:GetIdentityPoolRoles (AWS Service Authorization Reference)
  condition_note: Records the claim name and match type from RulesConfiguration.Rules[*].Claim / MatchType
    / Value. If the claim is writable by the pool user (User Pool user attribute not admin-only), classify
    as attacker_controllable=true (feeds aws-cognito-role-mapping-claim-override derived rule).
  false_positive_note: This edge represents role mapping configuration. Exploitability depends on the
    claim writeability (admin-only vs user-writable). The aws-cognito-role-mapping-claim-override derived
    rule consumes this edge and emits CanFederateAs with state based on claim writeability analysis.
  narrative: 'Identity Pool {pool.name} uses claim-based role rules: users whose token contains {claim.name}
    {match_type} ''{claim.value}'' receive IAM role {role.name}.'