rage.fail

aws-create-access-key

derived aws emits CanCreateCredentialFor

match (effective permission)

{ "action": "iam:CreateAccessKey", "resource_type": "AWS::IAM::User" }

emit

source type	`Identity`
source	`<principal>`
target	`<IAM user in scope>`
permissions	`iam:CreateAccessKey`

Narrative

{principal.name} can create access keys for {target.name} (iam:CreateAccessKey) and act as that user.

Raw rule rules/derived/aws/identity-escalation.yaml

id: aws-create-access-key
emits: CanCreateCredentialFor
match_effective_permission:
  action: iam:CreateAccessKey
  resource_type: AWS::IAM::User
emit:
  source_type: Identity
  source: <principal>
  target: <IAM user in scope>
  permissions:
  - iam:CreateAccessKey
  escalation: Mint programmatic keys for a more-privileged user and authenticate as them.
  narrative: '{principal.name} can create access keys for {target.name} (iam:CreateAccessKey) and act
    as that user.'