aws-eks-create-nodegroup-code-control

eks:CreateNodegroup combined with iam:PassRole (for a role trusting ec2.amazonaws.com or eks.amazonaws.com) allows an attacker to create a new managed node group with an attacker-controlled AMI or launch template. Every node in the group executes the attacker's code, and the attacker can escalate to the node group's IAM role.

derived aws emits CanModifyCode

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'cluster': None}

where

?principal has EFFECTIVE eks:CreateNodegroup on ?cluster ?principal has EFFECTIVE iam:PassRole for ?node_role (trusts ec2.amazonaws.com or eks.amazonaws.com) node_type(?cluster) == KubernetesCluster

emit

source type	`Identity`
target type	`KubernetesCluster`
source	`?principal`
target	`?cluster`
permissions	`eks:CreateNodegroup` `iam:PassRole`
conditions	`iam_permission` `role_compatibility`
state logic	CONDITIONAL(role_compatibility) when the principal has both eks:CreateNodegroup on the cluster AND iam:PassRole for a role that trusts ec2.amazonaws.com (standard EC2 node trust) or eks.amazonaws.com. The attacker can create a new managed node group with a custom launch template pointing to an attacker-controlled AMI, gaining CanModifyCode over every node in that group and transitively CanExecuteAs the node's IAM role. BLOCKED if an SCP denies eks:CreateNodegroup or iam:PassRole.

Narrative

{principal.name} holds eks:CreateNodegroup on cluster {cluster.name} and iam:PassRole for a node IAM role (trusting ec2.amazonaws.com). It can create a new managed node group with a custom launch template pointing to an attacker-controlled AMI, gaining code execution on every node in the group and privileges of the node's IAM role.

Raw rule rules/derived/aws/eks.yaml

id: aws-eks-create-nodegroup-code-control
emits: CanModifyCode
description: eks:CreateNodegroup combined with iam:PassRole (for a role trusting ec2.amazonaws.com or
  eks.amazonaws.com) allows an attacker to create a new managed node group with an attacker-controlled
  AMI or launch template. Every node in the group executes the attacker's code, and the attacker can escalate
  to the node group's IAM role.
match:
- - principal: null
  - HasPermission
  - cluster: null
where:
- ?principal has EFFECTIVE eks:CreateNodegroup on ?cluster
- ?principal has EFFECTIVE iam:PassRole for ?node_role (trusts ec2.amazonaws.com or eks.amazonaws.com)
- node_type(?cluster) == KubernetesCluster
emit:
  source_type: Identity
  target_type: KubernetesCluster
  source: ?principal
  target: ?cluster
  permissions:
  - eks:CreateNodegroup
  - iam:PassRole
  conditions:
  - iam_permission
  - role_compatibility
  state_logic: CONDITIONAL(role_compatibility) when the principal has both eks:CreateNodegroup on the
    cluster AND iam:PassRole for a role that trusts ec2.amazonaws.com (standard EC2 node trust) or eks.amazonaws.com.
    The attacker can create a new managed node group with a custom launch template pointing to an attacker-controlled
    AMI, gaining CanModifyCode over every node in that group and transitively CanExecuteAs the node's
    IAM role. BLOCKED if an SCP denies eks:CreateNodegroup or iam:PassRole.
  confidence: 0.85
  derived_from:
  - eks:CreateNodegroup effective permission on ?cluster
  - iam:PassRole effective permission for ?node_role (trusts ec2.amazonaws.com)
  false_positive_note: 'Requires the attacker to supply a custom launch template with an attacker-controlled
    AMI (or user-data script injection). The node group creation is immediate; code execution on the nodes
    follows once they are provisioned. Feeds container-chains image-push-poisons-consumers for supply-chain
    propagation and can-control escalate-via-execute-as for the node role privilege escalation. Honor
    iam:PassRole scoping: must verify the role trust includes ec2.amazonaws.com.'
  narrative: '{principal.name} holds eks:CreateNodegroup on cluster {cluster.name} and iam:PassRole for
    a node IAM role (trusting ec2.amazonaws.com). It can create a new managed node group with a custom
    launch template pointing to an attacker-controlled AMI, gaining code execution on every node in the
    group and privileges of the node''s IAM role.'