rage.fail

aws-ds-can-reset-user-password

explicit aws emits CanResetCredential

match (effective permission)

{ "action": "ds:ResetUserPassword", "resource_type": "AWS::DirectoryService::MicrosoftAD" }

emit

source type	`Identity`
target type	`HumanIdentity`
source	`<principal>`
target	`<DirectoryUser node(s) within the directory>`
permissions	`ds:ResetUserPassword`

Narrative

{principal.name} holds effective ds:ResetUserPassword on Managed AD directory {directory.name} and can reset the password of any user in that directory, taking over their Windows-authenticated session.

Raw rule rules/explicit/aws-ds.yaml

id: aws-ds-can-reset-user-password
emits: CanResetCredential
applies_to:
- aws
match_effective_permission:
  action: ds:ResetUserPassword
  resource_type: AWS::DirectoryService::MicrosoftAD
emit:
  source_type: Identity
  target_type: HumanIdentity
  source: <principal>
  target: <DirectoryUser node(s) within the directory>
  api_source: iam:SimulatePrincipalPolicy | policy evaluation
  permissions:
  - ds:ResetUserPassword
  evidence_field: effective ds:ResetUserPassword on directory ARN
  narrative: '{principal.name} holds effective ds:ResetUserPassword on Managed AD directory {directory.name}
    and can reset the password of any user in that directory, taking over their Windows-authenticated
    session.'
  note: ds:ResetUserPassword is scoped to the directory ARN; it grants blanket password-reset access over
    ALL users. When user enumeration (ds:DescribeUsers / ds:ListUsers via Identity Data Access) is available,
    emit one edge per user. Otherwise emit a single edge to the directory node as the target with scope="all
    users in directory". Rule 1 aws-ds-escalate-via-domain-admin-reset narrows to domain-admin users when
    MemberOf data is present.