aws-datapipeline-executes-as-pipeline-role

id: aws-datapipeline-executes-as-pipeline-role
emits: ExecutesAs
description: The Data Pipeline service assumes the pipeline's `role` field to provision compute resources
  and access downstream AWS services on the pipeline's behalf.
match_record:
  resource_type: AWS::DataPipeline::Pipeline
  field: pipelineObjects[type=Default].role
where:
- pipeline has a defined role field (non-empty string)
emit:
  source_type: Messaging
  target_type: Role
  source: <AWS::DataPipeline::Pipeline Workflow node>
  target: <IAM role ARN resolved from role field>
  state: ACTIVE
  conditions:
  - service_state
  permissions: []
  false_positive_note: The pipeline role is held by the DATA PIPELINE SERVICE, not by code that runs inside
    activities. It is used for control-plane operations (EC2 RunInstances, EMR CreateCluster, S3 writes
    for logs). An attacker who can modify the pipeline definition and activate it does NOT directly receive
    this role's credentials; they receive the resourceRole (rule 1) via IMDS. However, an attacker who
    CanPassIdentity to a privileged pipeline role and can activate the pipeline gains indirect leverage
    via the service's use of that role. Model the resourceRole (rule 1) as the primary execution-as target.
  narrative: The Data Pipeline service assumes {role.name} (the pipeline role on {pipeline.name}) to provision
    EC2/EMR resources and access downstream services. The role must trust datapipeline.amazonaws.com in
    its trust policy.