rage.fail

aws-ec2-get-password-data

derived aws emits CanReadCredential

match (effective permission)

{ "action": "ec2:GetPasswordData", "resource_type": "AWS::EC2::Instance" }

where

attacker holds the instance key pair private key (to decrypt)

emit

source	`<principal>`
target	`<Windows admin credential>`
permissions	`ec2:GetPasswordData`
conditions	`key_permission`
state logic	ACTIVE only if attacker has the key pair private key else CONDITIONAL(key_permission)

Narrative

{principal.name} can retrieve the encrypted Windows admin password of {instance.name} (ec2:GetPasswordData) and decrypt it with the key pair.

Raw rule rules/derived/aws/ec2.yaml

id: aws-ec2-get-password-data
emits: CanReadCredential
match_effective_permission:
  action: ec2:GetPasswordData
  resource_type: AWS::EC2::Instance
where:
- attacker holds the instance key pair private key (to decrypt)
emit:
  source: <principal>
  target: <Windows admin credential>
  permissions:
  - ec2:GetPasswordData
  conditions:
  - key_permission
  state_logic: ACTIVE only if attacker has the key pair private key else CONDITIONAL(key_permission)
  false_positive_note: GetPasswordData returns the RSA-encrypted admin password; useless without the matching
    private key. Windows only, and only for the auto-generated password.
  narrative: '{principal.name} can retrieve the encrypted Windows admin password of {instance.name} (ec2:GetPasswordData)
    and decrypt it with the key pair.'