rage.fail

aws-ec2-launch-template-version

derived aws emits CanModifyConfiguration

match (effective permission)

{ "action": "ec2:CreateLaunchTemplateVersion", "resource_type": "AWS::EC2::LaunchTemplate" }

where

attacker can set the new version as default (ec2:ModifyLaunchTemplate) OR a consumer selects $Latest

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<launch template>`
permissions	`ec2:CreateLaunchTemplateVersion` `ec2:ModifyLaunchTemplate?`
conditions	`role_compatibility`

Narrative

{principal.name} can publish a new default launch-template version for {template.name} (ec2:CreateLaunchTemplateVersion), controlling UserData and instance-profile of future launches.

Raw rule rules/derived/aws/ec2.yaml

id: aws-ec2-launch-template-version
emits: CanModifyConfiguration
match_effective_permission:
  action: ec2:CreateLaunchTemplateVersion
  resource_type: AWS::EC2::LaunchTemplate
optional_permission: ec2:ModifyLaunchTemplate
where:
- attacker can set the new version as default (ec2:ModifyLaunchTemplate) OR a consumer selects $Latest
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <launch template>
  permissions:
  - ec2:CreateLaunchTemplateVersion
  - ec2:ModifyLaunchTemplate?
  conditions:
  - role_compatibility
  escalation: Set UserData and IamInstanceProfile in a new default template version; future launches (incl.
    Auto Scaling) run attacker code as a chosen role.
  false_positive_note: Only impactful if something consumes the template ($Latest/$Default or ASG). Setting
    IamInstanceProfile still requires iam:PassRole for that role at launch time -> pair with the passer,
    else POTENTIAL.
  narrative: '{principal.name} can publish a new default launch-template version for {template.name} (ec2:CreateLaunchTemplateVersion),
    controlling UserData and instance-profile of future launches.'