aws-datapipeline-pass-resource-role

id: aws-datapipeline-pass-resource-role
emits: CanPassIdentity
description: iam:PassRole on a role that trusts ec2.amazonaws.com lets the principal bind it as the resourceRole
  in a Data Pipeline definition, enabling code running on the EC2/EMR node to execute as that role.
match_effective_permission:
  action: iam:PassRole
  resource_type: AWS::IAM::Role
where:
- principal has datapipeline:CreatePipeline OR datapipeline:PutPipelineDefinition
- target role trust policy allows ec2.amazonaws.com (for instance profile as resourceRole)
- iam:PassedToService condition (if any) includes ec2.amazonaws.com or datapipeline.amazonaws.com or is
  unconditioned
emit:
  source_type: Identity
  target_type: Role
  source: <principal>
  target: <IAM role passable as resourceRole>
  permissions:
  - iam:PassRole
  - datapipeline:CreatePipeline or datapipeline:PutPipelineDefinition
  conditions:
  - iam_permission
  - condition_expression
  - role_compatibility
  false_positive_note: "CRITICAL: honor iam:PassedToService. A role passable only to lambda.amazonaws.com\
    \ or ecs-tasks.amazonaws.com does NOT become a Data Pipeline resource role. The role must trust ec2.amazonaws.com\
    \ (for Ec2Resource instance profile) or datapipeline.amazonaws.com (for the pipeline role). When the\
    \ PassedToService condition is absent and the role trust is unconstrained, the pass is ACTIVE. When\
    \ the trust policy does NOT include ec2.amazonaws.com, downgrade to POTENTIAL(role_compatibility).\
    \ An attacker who can pass a role but has no datapipeline:PutPipelineDefinition or datapipeline:CreatePipeline\
    \ cannot use it \u2014 emit POTENTIAL in that case."
  narrative: '{principal.name} can pass {role.name} (iam:PassRole) as the resourceRole of a Data Pipeline
    EC2 or EMR resource node. EC2 nodes with that role expose its credentials via IMDS to any code the
    pipeline runs.'