aws-ec2-execute-as-attached-profile
Run code on an instance that ExecutesAs a role -> execute as that role.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
{'principal': None}
CanExecuteCommand {'instance': None}
{'instance': None} ExecutesAs {'role': None}
where
node_type(?instance) ==
VirtualMachine
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <IAM role> |
| permissions | <the CanExecuteCommand permission> |
| conditions | network_reachability service_state |
| state logic | ACTIVE if instance running and reachable else CONDITIONAL(service_state, network_reachability) |
Narrative
{principal.name} can run commands on {instance.name} which executes as {role.name}, therefore can act as {role.name}.
Raw rule rules/derived/aws/ec2.yaml
id: aws-ec2-execute-as-attached-profile
emits: CanExecuteAs
description: Run code on an instance that ExecutesAs a role -> execute as that role.
match:
- - principal: null
- CanExecuteCommand
- instance: null
- - instance: null
- ExecutesAs
- role: null
where:
- node_type(?instance) == VirtualMachine
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <IAM role>
permissions:
- <the CanExecuteCommand permission>
conditions:
- network_reachability
- service_state
escalation: OS command execution on a role-bearing instance yields the role's IMDS credentials.
state_logic: ACTIVE if instance running and reachable else CONDITIONAL(service_state, network_reachability)
narrative: '{principal.name} can run commands on {instance.name} which executes as {role.name}, therefore
can act as {role.name}.'