aws-config-remediation-create-workload-as

config:PutRemediationConfigurations + iam:PassRole sets the AutomationAssumeRole on a Config remediation configuration; when triggered, Config invokes SSM Automation as that role, yielding code execution as the passed role.

derived aws emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanPassIdentity {'role': None}

where

?principal has EFFECTIVE config:PutRemediationConfigurations (resource scope covers the target rule's remediation ARN or '*') ?role trust policy allows ssm.amazonaws.com (the remediation runner is an SSM Automation BuildWorker) iam:PassRole for ?role permits iam:PassedToService including ssm.amazonaws.com (or unconditioned)

emit

source type	`Identity`
target type	`Role`
source	`?principal`
target	`?role`
permissions	`config:PutRemediationConfigurations` `iam:PassRole`
conditions	`role_compatibility` `iam_permission`
state logic	if ?role trust policy or iam:PassedToService is unknown/unresolved: POTENTIAL(role_compatibility) — the PutRemediationConfigurations call would be rejected because the role does not trust ssm.amazonaws.com; elif both config:PutRemediationConfigurations and iam:PassRole are ACTIVE: ACTIVE — the caller can write a remediation configuration binding ?role to an SSM Automation runner; a trigger (Auto Remediation on first NON_COMPLIANT evaluation, or config:StartRemediationExecution) makes the runner execute as ?role. When Auto Remediation is enabled on the target rule, the first non-compliant evaluation provides an automatic trigger — ACTIVE. When only on-demand execution (config:StartRemediationExecution) is available, CONDITIONAL(trigger_exists) unless the caller also holds that permission. BLOCKED when an SCP denies config:PutRemediationConfigurations or iam:PassRole.

Narrative

{principal.name} can configure automated remediation for a Config rule (config:PutRemediationConfigurations), binding {role.name} as the AutomationAssumeRole (iam:PassRole to ssm.amazonaws.com). When remediation fires - automatically on NON_COMPLIANT evaluation or on-demand via config:StartRemediationExecution - Config invokes SSM Automation as {role.name}, executing attacker-controlled remediation steps with {role.name}'s privileges.

Raw rule rules/derived/aws/config.yaml

id: aws-config-remediation-create-workload-as
emits: CanCreateWorkloadAs
description: config:PutRemediationConfigurations + iam:PassRole sets the AutomationAssumeRole on a Config
  remediation configuration; when triggered, Config invokes SSM Automation as that role, yielding code
  execution as the passed role.
match:
- - principal: null
  - CanPassIdentity
  - role: null
where:
- ?principal has EFFECTIVE config:PutRemediationConfigurations (resource scope covers the target rule's
  remediation ARN or '*')
- ?role trust policy allows ssm.amazonaws.com (the remediation runner is an SSM Automation BuildWorker)
- iam:PassRole for ?role permits iam:PassedToService including ssm.amazonaws.com (or unconditioned)
emit:
  source_type: Identity
  target_type: Role
  source: ?principal
  target: ?role
  permissions:
  - config:PutRemediationConfigurations
  - iam:PassRole
  conditions:
  - role_compatibility
  - iam_permission
  state_logic: "if ?role trust policy or iam:PassedToService is unknown/unresolved: POTENTIAL(role_compatibility)\
    \ \u2014 the PutRemediationConfigurations call would be rejected because the role does not trust ssm.amazonaws.com;\
    \ elif both config:PutRemediationConfigurations and iam:PassRole are ACTIVE: ACTIVE \u2014 the caller\
    \ can write a remediation configuration binding ?role to an SSM Automation runner; a trigger (Auto\
    \ Remediation on first NON_COMPLIANT evaluation, or config:StartRemediationExecution) makes the runner\
    \ execute as ?role. When Auto Remediation is enabled on the target rule, the first non-compliant evaluation\
    \ provides an automatic trigger \u2014 ACTIVE. When only on-demand execution (config:StartRemediationExecution)\
    \ is available, CONDITIONAL(trigger_exists) unless the caller also holds that permission. BLOCKED\
    \ when an SCP denies config:PutRemediationConfigurations or iam:PassRole."
  confidence: 0.88
  derived_from:
  - ?principal CanPassIdentity ?role
  - effective config:PutRemediationConfigurations
  false_positive_note: "CITE can-execute-as:execute-as-via-new-workload \u2014 do NOT re-derive CanExecuteAs\
    \ here. The CanExecuteAs collapse (CanCreateWorkloadAs -> CanExecuteAs) is already owned by can-execute-as.yaml.\
    \ This rule emits only CanCreateWorkloadAs: the act of CREATING the remediation configuration binding\
    \ with a passed role. Honor iam:PassedToService: a role passable only to ec2.amazonaws.com does NOT\
    \ work here \u2014 the remediation runner is SSM Automation (ssm.amazonaws.com). The SSM document\
    \ used for remediation must exist and be accessible; if the caller specifies a custom document they\
    \ also control, the path is ACTIVE (they control both the definition and the role). AWS-provided remediation\
    \ documents (AWS-* prefixed) cannot be modified \u2014 no additional CanModifyCode risk from those.\
    \ RemediationConfiguration nodes are typed as AutomationService (ManagementService subclass), NOT\
    \ as Compute; the execute-as roll-up via execute-as-via-config-identity-swap (which requires Compute\
    \ node class) does NOT apply. The execution consequence derives from execute-as-via-new-workload (which\
    \ only requires CanCreateWorkloadAs, no node class gate)."
  narrative: "{principal.name} can configure automated remediation for a Config rule (config:PutRemediationConfigurations),\
    \ binding {role.name} as the AutomationAssumeRole (iam:PassRole to ssm.amazonaws.com). When remediation\
    \ fires \u2014 automatically on NON_COMPLIANT evaluation or on-demand via config:StartRemediationExecution\
    \ \u2014 Config invokes SSM Automation as {role.name}, executing attacker-controlled remediation steps\
    \ with {role.name}'s privileges."