aws-emr-create-cluster-as

Create a new EMR cluster bound to a passable privileged JobFlowRole via RunJobFlow + iam:PassRole.

derived aws emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`?role`
permissions	`elasticmapreduce:RunJobFlow` `iam:PassRole`
conditions	`iam_permission` `role_compatibility`
state logic	ACTIVE when principal has EFFECTIVE RunJobFlow AND the iam:PassRole PassedToService / ARN scope admits elasticmapreduce.amazonaws.com for the service role and ec2.amazonaws.com for the instance profile. CONDITIONAL(role_compatibility) when PassedToService or trust constraints are unknown/unresolved. POTENTIAL(role_compatibility) when the principal has RunJobFlow but PassRole is not yet proven. BLOCKED if either action is blocked by SCP/boundary.

source type

Identity

target type

Identity

source

?principal

target

?role

permissions

elasticmapreduce:RunJobFlow iam:PassRole

conditions

iam_permission role_compatibility

state logic

ACTIVE when principal has EFFECTIVE RunJobFlow AND the iam:PassRole PassedToService / ARN scope admits elasticmapreduce.amazonaws.com for the service role and ec2.amazonaws.com for the instance profile. CONDITIONAL(role_compatibility) when PassedToService or trust constraints are unknown/unresolved. POTENTIAL(role_compatibility) when the principal has RunJobFlow but PassRole is not yet proven. BLOCKED if either action is blocked by SCP/boundary.

Narrative

{principal.name} can create a new EMR cluster bound to {role.name} as the instance profile (elasticmapreduce:RunJobFlow + iam:PassRole); the cluster runs as {role.name} and any submitted steps execute with those credentials.

Raw rule rules/derived/aws/emr.yaml

id: aws-emr-create-cluster-as
emits: CanCreateWorkloadAs
description: Create a new EMR cluster bound to a passable privileged JobFlowRole via RunJobFlow + iam:PassRole.
match:
- - principal: null
  - CanPassIdentity
  - role: null
where:
- ?principal has EFFECTIVE elasticmapreduce:RunJobFlow
- ?role passable to elasticmapreduce.amazonaws.com / ec2.amazonaws.com (JobFlowRole trust)
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?role
  permissions:
  - elasticmapreduce:RunJobFlow
  - iam:PassRole
  conditions:
  - iam_permission
  - role_compatibility
  state_logic: ACTIVE when principal has EFFECTIVE RunJobFlow AND the iam:PassRole PassedToService / ARN
    scope admits elasticmapreduce.amazonaws.com for the service role and ec2.amazonaws.com for the instance
    profile. CONDITIONAL(role_compatibility) when PassedToService or trust constraints are unknown/unresolved.
    POTENTIAL(role_compatibility) when the principal has RunJobFlow but PassRole is not yet proven. BLOCKED
    if either action is blocked by SCP/boundary.
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - <CanPassIdentity(aws-emr-pass-job-flow-role) edge_id>
  false_positive_note: "Distinguish from aws-emr-execute-as-run-job-flow: CanCreateWorkloadAs is the capability\
    \ to create and bind the workload (create + PassRole); CanExecuteAs is the realized execution of attacker\
    \ code as ?role. This edge captures the create/bind step; the execute path flows through CanModifyCode\
    \ on the new cluster. Honor iam:PassedToService \u2014 a role passable only to lambda.amazonaws.com\
    \ cannot be a JobFlowRole and this edge must be POTENTIAL/CONDITIONAL."
  narrative: '{principal.name} can create a new EMR cluster bound to {role.name} as the instance profile
    (elasticmapreduce:RunJobFlow + iam:PassRole); the cluster runs as {role.name} and any submitted steps
    execute with those credentials.'