aws-cognito-update-identity-pool

id: aws-cognito-update-identity-pool
emits: CanModifyTrust
applies_to:
- aws
match_effective_permission:
  action: cognito-identity:UpdateIdentityPool
  resource_type: AWS::Cognito::IdentityPool
emit:
  source_type: Identity
  target_type: Role
  source: <principal with effective cognito-identity:UpdateIdentityPool>
  target: <the Identity Pool's mapped role (or TrustPolicy representing pool access control)>
  permissions:
  - cognito-identity:UpdateIdentityPool
  - iam:PassRole
  state_logic: ACTIVE when the principal holds effective cognito-identity:UpdateIdentityPool on an Identity
    Pool ARN. Can flip AllowUnauthenticatedIdentities from false to true (converting secure pool to public-entry
    pool) or modify RoleMapping rules to redirect claims to privileged roles. CONDITIONAL(role_compatibility)
    if the new role requires iam:PassRole and the principal lacks it.
  confidence: 0.85
  derived_from:
  - cognito-identity:UpdateIdentityPool (AWS Service Authorization Reference)
  false_positive_note: 'UpdateIdentityPool can (a) flip AllowUnauthenticatedIdentities to true (persistent,
    visible config change affecting all pool users) and (b) modify RoleMappings to redirect claims to
    privileged roles. Confirm the attacker has not only UpdateIdentityPool permission but also iam:PassRole
    for any new role they assign (per AWS Service Authorization Reference). Include visibility note: this
    is not a stealth attack; it modifies pool configuration visible to all users and admins.'
  narrative: '{principal.name} can call cognito-identity:UpdateIdentityPool on Identity Pool {pool.name}
    to flip AllowUnauthenticatedIdentities to true (if currently false) or modify role mappings, redirecting
    claims to privileged IAM roles and affecting all pool users.'