aws-cognito-set-identity-pool-roles

id: aws-cognito-set-identity-pool-roles
emits: CanModifyTrust
applies_to:
- aws
match_effective_permission:
  action: cognito-identity:SetIdentityPoolRoles
  resource_type: AWS::Cognito::IdentityPool
emit:
  source_type: Identity
  target_type: Role
  source: <principal with effective cognito-identity:SetIdentityPoolRoles>
  target: <IAM Role passable to Cognito Identity service (cross-ref with iam:PassRole)>
  permissions:
  - cognito-identity:SetIdentityPoolRoles
  - iam:PassRole
  state_logic: ACTIVE when the principal holds effective cognito-identity:SetIdentityPoolRoles on an Identity
    Pool ARN AND iam:PassRole on the target role has no iam:PassedToService restriction excluding cognito-identity.amazonaws.com.
    POTENTIAL(role_compatibility) when the PassRole scope or PassedToService condition cannot be confirmed.
    BLOCKED if an SCP denies SetIdentityPoolRoles or iam:PassRole.
  confidence: 0.85
  derived_from:
  - cognito-identity:SetIdentityPoolRoles
  - iam:PassRole (AWS Service Authorization Reference)
  false_positive_note: "iam:PassRole is required by Cognito Identity Pools when setting role mappings\
    \ (per AWS docs: the caller must hold iam:PassRole for each role placed in the mapping). Without it,\
    \ SetIdentityPoolRoles returns AccessDenied. Verify that the PassRole resource covers the target role\
    \ AND that any iam:PassedToService condition does not exclude cognito-identity.amazonaws.com. Note\
    \ that applying this change is permanent and visible: it modifies the pool's configuration and affects\
    \ ALL users \u2014 it is not a stealth attack; include in the narrative."
  narrative: '{principal.name} can call cognito-identity:SetIdentityPoolRoles on Identity Pool {pool.name}
    and pass {target_role.name} (iam:PassRole), rewriting the pool''s role mapping, making all future
    pool users receive credentials for a privileged IAM role.'