aws-datapipeline-exposes-resource-role-cred

id: aws-datapipeline-exposes-resource-role-cred
emits: ExposesCredential
description: A pipeline's EC2 or EMR resource node exposes the resourceRole's temporary credentials to
  any code running in its activities via the IMDS endpoint.
match:
- - ec2resource: null
  - ExecutesAs
  - role: null
where:
- node_type(?ec2resource) in [VirtualMachine, AnalyticsService]
- ?ec2resource is a Data Pipeline Ec2Resource or EmrCluster node (provider_type check)
emit:
  source_type: Compute
  target_type: Role
  source: ?ec2resource
  target: ?role
  permissions: []
  conditions:
  - service_state
  derived_from:
  - ?ec2resource ExecutesAs ?role (aws-datapipeline-executes-as-resource-role)
  - "credential-chains:execute-then-read-secret (downstream \u2014 cited not re-derived)"
  false_positive_note: "Not an escalation by itself \u2014 it asserts that code-execution on the EC2/EMR\
    \ resource equals holding the resourceRole's credentials (standard IMDS exposure). Path value comes\
    \ from a contributing CanModifyCode + CanTrigger chain (rules 8-9). IMDSv2 does NOT block this: IMDSv2\
    \ requires only a PUT to get a token (no credential required), and code running on the instance can\
    \ perform the PUT. IMDSv2 with hop-limit 1 blocks requests from nested containers but not from code\
    \ running directly on the host (ShellCommandActivity on Ec2Resource runs on the host). Model as BLOCKED\
    \ only if IMDSv2 with hop-limit 1 AND the activity runs inside a container that cannot reach IMDS\
    \ (unlikely default)."
  narrative: "The EC2/EMR resource node {resource.name} in the Data Pipeline runs as {role.name}. Any\
    \ code executing in a ShellCommandActivity or bootstrap action on this resource can query IMDS (http://169.254.169.254/latest/meta-data/\
    \ iam/security-credentials/{role.name}) and obtain {role.name}'s temporary AWS credentials \u2014\
    \ standard instance-profile credential exposure."