aws-cognito-role-trust-cognito-identity

id: aws-cognito-role-trust-cognito-identity
emits: TrustsExternalIdentity
applies_to:
- aws
match_record:
  resource_type: AWS::IAM::Role
  api_source: iam:GetRole
  field: AssumeRolePolicyDocument
  match_condition: Statement[].Principal.Federated contains 'cognito-identity.amazonaws.com'
emit:
  source_type: Role
  target_type: FederatedIdentity
  source: <IAM Role node>
  target: <FederatedIdentity node (Cognito identity pool)>
  permissions:
  - sts:AssumeRoleWithWebIdentity
  evidence_field: AssumeRolePolicyDocument.Statement[].Condition
  state_logic: "ACTIVE \u2014 this edge represents a collected trust policy fact (inventory)."
  confidence: 0.99
  derived_from:
  - iam:GetRole (AWS Service Authorization Reference)
  condition_note: Record cognito-identity:aud value (pool ID; absent = any pool in account), cognito-identity:amr
    value (absent = any caller; 'authenticated' = any authed caller; specific provider = PINNED). Classify
    BROAD when amr is absent or only 'authenticated' (not provider-specific). Classify PINNED when amr
    specifies a single provider URL. Record aws:SourceArn condition if present (narrows which trust anchor
    / pool). Trust condition properties feed federation-chains.yaml federation-maps-to-identity state
    gate (ACTIVE for BROAD, CONDITIONAL for PINNED).
  false_positive_note: This edge represents a trust policy fact. Exploitability depends on the trust condition
    breadth (amr/aud pinning). Confirm the trust policy condition before inferring escalation. The federation-chains.yaml
    rules consume this edge and emit CanFederateAs with state based on trust condition breadth.
  narrative: "IAM role {role.name} trusts cognito-identity.amazonaws.com (AssumeRolePolicyDocument.Federated);\
    \ conditions: aud={aud}, amr={amr} \u2014 trust_condition_breadth: {BROAD|PINNED}."