aws-datapipeline-add-tags-bypass

id: aws-datapipeline-add-tags-bypass
emits: CanModifyConfiguration
description: datapipeline:AddTags allows altering pipeline tags used in IAM conditions, potentially defeating
  tag-based access restrictions.
match_effective_permission:
  action: datapipeline:AddTags
  resource_type: AWS::DataPipeline::Pipeline
emit:
  source_type: Identity
  target_type: Messaging
  source: <principal>
  target: <AWS::DataPipeline::Pipeline Workflow node>
  permissions:
  - datapipeline:AddTags
  conditions:
  - iam_permission
  - condition_expression
  false_positive_note: "datapipeline:AddTags alone cannot remove tags used in deny conditions (only AddTags\
    \ permission, no RemoveTags). However, this can add tags that match permissive IAM conditions (datapipeline:Tag),\
    \ unlocking otherwise tag-gated operations on rules 3-5 and 8-9. Over-claim guard: if a deny condition\
    \ on datapipeline:Tag blocks an action, and the attacker has only AddTags without RemoveTags, the\
    \ deny cannot be removed \u2014 downgrade such paths to CONDITIONAL(condition_expression). If the\
    \ attacker has both AddTags and RemoveTags, full tag mutation is possible \u2014 model as ACTIVE CanModifyConfiguration\
    \ on the tags themselves."
  narrative: '{principal.name} can add tags to pipeline {pipeline.name} (datapipeline:AddTags), potentially
    matching IAM conditions that gate other operations. This can defeat tag-based access restrictions
    (datapipeline:Tag conditions) that otherwise block PutPipelineDefinition, ActivatePipeline, or SetStatus
    on that pipeline.'