rage.fail

aws-ec2-instance-connect-serial

derived aws emits CanExecuteCommand

match (effective permission)

{ "action": "ec2-instance-connect:SendSerialConsoleSSHPublicKey", "resource_type": "AWS::EC2::Instance" }

where

account/instance serial-console access enabled

emit

source type	`Identity`
source	`<principal>`
target	`<EC2 instance>`
permissions	`ec2-instance-connect:SendSerialConsoleSSHPublicKey`
conditions	`service_state`

Narrative

{principal.name} can access the serial console of {instance.name} (ec2-instance-connect:SendSerialConsoleSSHPublicKey).

Raw rule rules/derived/aws/ec2.yaml

id: aws-ec2-instance-connect-serial
emits: CanExecuteCommand
match_effective_permission:
  action: ec2-instance-connect:SendSerialConsoleSSHPublicKey
  resource_type: AWS::EC2::Instance
where:
- account/instance serial-console access enabled
emit:
  source_type: Identity
  source: <principal>
  target: <EC2 instance>
  permissions:
  - ec2-instance-connect:SendSerialConsoleSSHPublicKey
  conditions:
  - service_state
  false_positive_note: Serial console must be enabled at account level and the OS must have a password/console
    login; otherwise POTENTIAL.
  narrative: '{principal.name} can access the serial console of {instance.name} (ec2-instance-connect:SendSerialConsoleSSHPublicKey).'