aws-datapipeline-pass-pipeline-role
iam:PassRole on a role that trusts datapipeline.amazonaws.com lets the principal bind it as the pipeline role, used by the Data Pipeline service to provision EC2/EMR resources and access downstream AWS services.
match (effective permission)
{
"action": "iam:PassRole",
"resource_type": "AWS::IAM::Role"
}
where
principal has datapipeline:CreatePipeline OR datapipeline:PutPipelineDefinition
target role trust policy allows datapipeline.amazonaws.com
iam:PassedToService condition (if any) includes datapipeline.amazonaws.com or is unconditioned
emit
| source type | Identity |
|---|---|
| target type | Role |
| source | <principal> |
| target | <IAM role passable as pipeline role> |
| permissions | iam:PassRole datapipeline:CreatePipeline or datapipeline:PutPipelineDefinition |
| conditions | iam_permission condition_expression role_compatibility |
Narrative
{principal.name} can pass {role.name} as the Data Pipeline service role (datapipeline.amazonaws.com trust). The pipeline service will use {role.name} to provision resources and access AWS services on behalf of the pipeline.
Raw rule rules/derived/aws/datapipeline.yaml
id: aws-datapipeline-pass-pipeline-role
emits: CanPassIdentity
description: iam:PassRole on a role that trusts datapipeline.amazonaws.com lets the principal bind it
as the pipeline role, used by the Data Pipeline service to provision EC2/EMR resources and access downstream
AWS services.
match_effective_permission:
action: iam:PassRole
resource_type: AWS::IAM::Role
where:
- principal has datapipeline:CreatePipeline OR datapipeline:PutPipelineDefinition
- target role trust policy allows datapipeline.amazonaws.com
- iam:PassedToService condition (if any) includes datapipeline.amazonaws.com or is unconditioned
emit:
source_type: Identity
target_type: Role
source: <principal>
target: <IAM role passable as pipeline role>
permissions:
- iam:PassRole
- datapipeline:CreatePipeline or datapipeline:PutPipelineDefinition
conditions:
- iam_permission
- condition_expression
- role_compatibility
false_positive_note: 'Honor iam:PassedToService: a role passable only to ec2.amazonaws.com does NOT
become a pipeline role. The pipeline role is used by the DATA PIPELINE SERVICE for control-plane operations
(RunInstances, CreateCluster), not for code running in activities. An attacker who passes a privileged
pipeline role gains indirect escalation through the service''s provisioning actions, not direct credential
access. The resourceRole (rule 6) is typically the higher-value target for code execution.'
narrative: '{principal.name} can pass {role.name} as the Data Pipeline service role (datapipeline.amazonaws.com
trust). The pipeline service will use {role.name} to provision resources and access AWS services on
behalf of the pipeline.'