aws-datapipeline-create-workload-as

datapipeline:CreatePipeline + iam:PassRole for a role (resourceRole passable to ec2.amazonaws.com) lets the principal spawn a new pipeline workload running as that role.

derived aws emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanPassIdentity {'role': None}

where

?principal has EFFECTIVE datapipeline:CreatePipeline AND datapipeline:PutPipelineDefinition ?role trust policy allows ec2.amazonaws.com (passable as resourceRole instance profile) iam:PassedToService condition (if any) includes ec2.amazonaws.com or is unconditioned

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`?role`
permissions	`datapipeline:CreatePipeline` `datapipeline:PutPipelineDefinition` `datapipeline:ActivatePipeline (optional for full exploitation)` `iam:PassRole`
conditions	`iam_permission` `condition_expression` `role_compatibility`
state logic	ACTIVE when CreatePipeline, PutPipelineDefinition, and iam:PassRole are confirmed EFFECTIVE and the role trust admits ec2.amazonaws.com (or PassedToService is unconditioned). ActivatePipeline is optional for full exploitation but not required for CanCreateWorkloadAs (the workload can run on built-in schedules without explicit trigger permission). POTENTIAL (role_compatibility) when the role trust or iam:PassedToService is unknown/unresolved. CONDITIONAL(iam_permission) when any of the three required actions (CreatePipeline, PutPipelineDefinition, PassRole) is missing. Inherits from CanPassIdentity contributor (weakest state rule).

Narrative

{principal.name} can create a new Data Pipeline (datapipeline:CreatePipeline + datapipeline:PutPipelineDefinition), pass {role.name} as the resourceRole (iam:PassRole to ec2.amazonaws.com), and activate it, spawning an EC2 workload that runs as {role.name}. can-execute-as:execute-as-via-new-workload produces CanExecuteAs(?principal, ?role) from this CanCreateWorkloadAs edge.

Raw rule rules/derived/aws/datapipeline.yaml

id: aws-datapipeline-create-workload-as
emits: CanCreateWorkloadAs
description: datapipeline:CreatePipeline + iam:PassRole for a role (resourceRole passable to ec2.amazonaws.com)
  lets the principal spawn a new pipeline workload running as that role.
match:
- - principal: null
  - CanPassIdentity
  - role: null
where:
- ?principal has EFFECTIVE datapipeline:CreatePipeline AND datapipeline:PutPipelineDefinition
- ?role trust policy allows ec2.amazonaws.com (passable as resourceRole instance profile)
- iam:PassedToService condition (if any) includes ec2.amazonaws.com or is unconditioned
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?role
  permissions:
  - datapipeline:CreatePipeline
  - datapipeline:PutPipelineDefinition
  - datapipeline:ActivatePipeline (optional for full exploitation)
  - iam:PassRole
  conditions:
  - iam_permission
  - condition_expression
  - role_compatibility
  state_logic: ACTIVE when CreatePipeline, PutPipelineDefinition, and iam:PassRole are confirmed EFFECTIVE
    and the role trust admits ec2.amazonaws.com (or PassedToService is unconditioned). ActivatePipeline
    is optional for full exploitation but not required for CanCreateWorkloadAs (the workload can run on
    built-in schedules without explicit trigger permission). POTENTIAL (role_compatibility) when the role
    trust or iam:PassedToService is unknown/unresolved. CONDITIONAL(iam_permission) when any of the three
    required actions (CreatePipeline, PutPipelineDefinition, PassRole) is missing. Inherits from CanPassIdentity
    contributor (weakest state rule).
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - ?principal CanPassIdentity ?role (aws-datapipeline-pass-resource-role)
  - "can-execute-as:execute-as-via-new-workload (linchpin \u2014 cited; CanCreateWorkloadAs -> CanExecuteAs)"
  false_positive_note: "Modeling consistency: datapipeline:CreatePipeline is the CanDeploy-equivalent\
    \ for Data Pipeline. No separate CanDeploy(principal -> DataPipeline platform) edge is emitted; this\
    \ rule folds CreatePipeline directly as the deploy step. Graph consumers keying strictly off CanDeploy\
    \ will not see this path \u2014 this is intentional (CreatePipeline~CanDeploy fold, per lambda.yaml\
    \ note). Honor iam:PassedToService: a role passable only to lambda.amazonaws.com does NOT become a\
    \ Data Pipeline resourceRole; downgrade to POTENTIAL."
  narrative: '{principal.name} can create a new Data Pipeline (datapipeline:CreatePipeline + datapipeline:PutPipelineDefinition),
    pass {role.name} as the resourceRole (iam:PassRole to ec2.amazonaws.com), and activate it, spawning
    an EC2 workload that runs as {role.name}. can-execute-as:execute-as-via-new-workload produces CanExecuteAs(?principal,
    ?role) from this CanCreateWorkloadAs edge.'