aws-eks-create-pod-identity-association-redirect

id: aws-eks-create-pod-identity-association-redirect
emits: CanModifyConfiguration
description: eks:CreatePodIdentityAssociation lets an IAM principal link any namespace:SA to any IAM role
  it can pass (iam:PassRole). An attacker with this permission can reroute an existing SA to a more-privileged
  role, or add a new association for a SA they can run pods as, gaining that role's credentials at the
  next pod startup.
match:
- - principal: null
  - HasPermission
  - cluster: null
where:
- ?principal has EFFECTIVE eks:CreatePodIdentityAssociation on ?cluster
- ?principal has EFFECTIVE iam:PassRole for ?iam_role (trusts pods.eks.amazonaws.com)
- node_type(?cluster) == KubernetesCluster
emit:
  source_type: Identity
  target_type: KubernetesCluster
  source: ?principal
  target: ?cluster
  permissions:
  - eks:CreatePodIdentityAssociation
  - iam:PassRole
  conditions:
  - iam_permission
  - role_compatibility
  state_logic: "CONDITIONAL(role_compatibility) \u2014 the principal can create a Pod Identity association\
    \ for a role it can pass (iam:PassRole), but the full exploitation requires the principal to schedule\
    \ a pod as the target namespace:SA pair. If the principal lacks the Kubernetes RBAC or cluster IAM\
    \ permissions to create/schedule a pod as the target SA, the association is created but the attacker\
    \ cannot trigger the credential delivery -> remains CONDITIONAL until a pod is actually scheduled.\
    \ The eks-pod-identity-agent DaemonSet must also be running on the node (service_state factor). BLOCKED\
    \ if an SCP denies eks:CreatePodIdentityAssociation or iam:PassRole."
  confidence: 0.85
  derived_from:
  - eks:CreatePodIdentityAssociation effective permission on ?cluster
  - iam:PassRole effective permission for ?iam_role (pods.eks.amazonaws.com)
  false_positive_note: 'This emits CanModifyConfiguration (config of the cluster''s workload-identity
    mapping), not CanExecuteAs directly. The CanExecuteAs consequence follows from: CanModifyConfiguration(?cluster)
    -> new Pod Identity Association -> aws-eks-pod-identity-association emits CanFederateAs(?ksa -> ?iam_role)
    -> container-chains / federation-chains roll up CanExecuteAs. Do not shortcut this to CanExecuteAs
    from CanModifyConfiguration alone. The state is CONDITIONAL because the attacker must ALSO be able
    to schedule a pod as the target namespace:SA pair (via Kubernetes RBAC, cluster-admin, or eks:CreatePodIdentityAssociation
    alone if paired with the ability to create workloads). Honor iam:PassRole scoping: must check PassedToService=pods.eks.amazonaws.com
    (if conditioned). Honor the rule''s state: if the role is passable but the attacker has no way to
    run a pod as the target SA, the reachable state is CONDITIONAL(role_compatibility), not ACTIVE.'
  narrative: '{principal.name} holds eks:CreatePodIdentityAssociation on cluster {cluster.name} and iam:PassRole
    for a role trusting pods.eks.amazonaws.com. It can create a Pod Identity Association linking any namespace:SA
    to that role; pods subsequently started as that SA receive the role''s credentials from the pod-identity-agent
    (169.254.170.23). Realization requires the principal to schedule a pod as the target SA.'