rage.fail

aws-ds-can-reset-user-password-ad-connector

explicit aws emits CanResetCredential

match (effective permission)

{ "action": "ds:ResetUserPassword", "resource_type": "AWS::DirectoryService::ADConnector" }

emit

source type	`Identity`
target type	`HumanIdentity`
source	`<principal>`
target	`<DirectoryUser node(s) within the on-prem AD behind this Connector>`
permissions	`ds:ResetUserPassword`

Narrative

{principal.name} holds effective ds:ResetUserPassword on AD Connector {directory.name} and can reset passwords of any user in the on-prem Active Directory that this Connector proxies to, via LDAP to the on-prem AD.

Raw rule rules/explicit/aws-ds.yaml

id: aws-ds-can-reset-user-password-ad-connector
emits: CanResetCredential
applies_to:
- aws
match_effective_permission:
  action: ds:ResetUserPassword
  resource_type: AWS::DirectoryService::ADConnector
emit:
  source_type: Identity
  target_type: HumanIdentity
  source: <principal>
  target: <DirectoryUser node(s) within the on-prem AD behind this Connector>
  api_source: iam:SimulatePrincipalPolicy | policy evaluation
  permissions:
  - ds:ResetUserPassword
  evidence_field: effective ds:ResetUserPassword on AD Connector ARN
  narrative: '{principal.name} holds effective ds:ResetUserPassword on AD Connector {directory.name} and
    can reset passwords of any user in the on-prem Active Directory that this Connector proxies to, via
    LDAP to the on-prem AD.'
  note: AD Connector is a proxy to an on-prem AD; password resets via the Connector propagate to the on-prem
    directory and affect real Windows-domain credentials used by on-prem resources and potentially hybrid
    workloads. This is a cross-boundary credential-reset capability (AWS control-plane to on-prem AD).
    Emit per user if enumeration data is available; otherwise emit a blanket edge to the Connector/directory
    node. The escalation chain (CanEscalateTo) depends on the target user's group membership in the on-prem
    AD.