aws-datapipeline-executes-as-resource-role

id: aws-datapipeline-executes-as-resource-role
emits: ExecutesAs
description: A pipeline's EC2 or EMR resource node executes as the IAM role in the pipeline's resourceRole
  field, making that role reachable via IMDS by any code the pipeline runs.
match_record:
  resource_type: AWS::DataPipeline::Pipeline
  field: pipelineObjects[type=Ec2Resource or type=EmrCluster].resourceRole
where:
- pipeline has a defined resourceRole (non-empty string)
emit:
  source_type: Compute
  target_type: Role
  source: <EC2Resource or EmrCluster compute node spawned by the pipeline>
  target: <IAM role ARN resolved from resourceRole field>
  state: ACTIVE
  conditions:
  - service_state
  permissions: []
  false_positive_note: "Emit only when the pipeline has at least one Ec2Resource or EmrCluster resource\
    \ object with a non-empty resourceRole. A pipeline that runs only via a Task Runner (workerGroup,\
    \ no runsOn EC2 resource) does NOT expose IMDS credentials \u2014 it uses the Task Runner's own instance\
    \ credentials on a self-managed host; model that as a separate ExecutesAs on the Task Runner EC2 node\
    \ itself, not the pipeline. Do not emit for pipelines in INACTIVE/FINISHED state with no pending schedule\
    \ runs."
  narrative: The {resource.type} resource node in pipeline {pipeline.name} runs as {role.name} (the pipeline's
    resourceRole). Any code executing in a ShellCommandActivity / EmrActivity on this resource can retrieve
    {role.name}'s temporary credentials from the IMDS endpoint (http://169.254.169.254/latest/meta-data/iam/security-credentials/).