aws-create-role-and-assume
Create a new role with admin trust + policy, then assume it.
where
?principal has iam:CreateRole
?principal has (iam:AttachRolePolicy OR iam:PutRolePolicy)
?principal has sts:AssumeRole (or sets trust to self)
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <synthetic admin role> |
| permissions | iam:CreateRole iam:AttachRolePolicy sts:AssumeRole |
Narrative
{principal.name} can create a role with an admin policy and a self-trust, then assume it (iam:CreateRole + AttachRolePolicy + sts:AssumeRole).
Raw rule rules/derived/aws/identity-escalation.yaml
id: aws-create-role-and-assume
emits: CanEscalateTo
description: Create a new role with admin trust + policy, then assume it.
where:
- ?principal has iam:CreateRole
- ?principal has (iam:AttachRolePolicy OR iam:PutRolePolicy)
- ?principal has sts:AssumeRole (or sets trust to self)
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <synthetic admin role>
permissions:
- iam:CreateRole
- iam:AttachRolePolicy
- sts:AssumeRole
narrative: '{principal.name} can create a role with an admin policy and a self-trust, then assume it
(iam:CreateRole + AttachRolePolicy + sts:AssumeRole).'