rage.fail

aws-ec2-associate-instance-profile

Attach an instance profile (role) to an instance the attacker can run code on.

derived aws emits CanAttachIdentity

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanPassIdentity {'role': None}

where

?principal has EFFECTIVE ec2:AssociateIamInstanceProfile on ?instance ?instance has no existing profile OR attacker also has ec2:DisassociateIamInstanceProfile ?role trust policy allows ec2.amazonaws.com; PassedToService includes ec2

emit

source type	`Identity`
target type	`Compute`
source	`<principal>`
target	`<EC2 instance>`
permissions	`iam:PassRole` `ec2:AssociateIamInstanceProfile` `iam:AddRoleToInstanceProfile`
conditions	`role_compatibility` `iam_permission`

Narrative

{principal.name} can attach instance profile role {role.name} to {instance.name} (ec2:AssociateIamInstanceProfile + iam:PassRole).

Raw rule rules/derived/aws/ec2.yaml

id: aws-ec2-associate-instance-profile
emits: CanAttachIdentity
description: Attach an instance profile (role) to an instance the attacker can run code on.
match:
- - principal: null
  - CanPassIdentity
  - role: null
where:
- ?principal has EFFECTIVE ec2:AssociateIamInstanceProfile on ?instance
- ?instance has no existing profile OR attacker also has ec2:DisassociateIamInstanceProfile
- ?role trust policy allows ec2.amazonaws.com; PassedToService includes ec2
emit:
  source_type: Identity
  target_type: Compute
  source: <principal>
  target: <EC2 instance>
  permissions:
  - iam:PassRole
  - ec2:AssociateIamInstanceProfile
  - iam:AddRoleToInstanceProfile
  conditions:
  - role_compatibility
  - iam_permission
  note: Chains to CanExecuteAs(role) once the attacker can run code on the instance (SSM/Instance Connect/UserData)
    or read its IMDS.
  false_positive_note: AssociateIamInstanceProfile only succeeds on an instance without a profile; replacing
    one needs ReplaceIamInstanceProfileAssociation (see aws-ec2-replace-instance-profile). Honor PassedToService=ec2
    and role trust.
  narrative: '{principal.name} can attach instance profile role {role.name} to {instance.name} (ec2:AssociateIamInstanceProfile
    + iam:PassRole).'