aws-emr-execute-as-run-job-flow

Create a new EMR cluster with a privileged JobFlowRole via RunJobFlow + iam:PassRole; arbitrary bootstrap/step code executes as that role.

derived aws emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanModifyCode {'cluster': None} {'principal': None} CanPassIdentity {'role': None}

where

node_type(?cluster) == AnalyticsService ?cluster provider_type == AWS::EMR::Cluster CanModifyCode here is aws-emr-run-job-flow-code (RunJobFlow + PassRole for new cluster creation) CanPassIdentity here is aws-emr-pass-job-flow-role (PassRole for JobFlowRole instance profile)

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`?role`
permissions	`elasticmapreduce:RunJobFlow` `iam:PassRole`
conditions	`iam_permission` `role_compatibility`
state logic	ACTIVE when the principal has EFFECTIVE RunJobFlow AND iam:PassRole for the ServiceRole (elasticmapreduce.amazonaws.com) AND the JobFlowRole (ec2.amazonaws.com) — all iam:PassedToService conditions satisfied. CONDITIONAL(role_compatibility) when PassedToService for either role is unknown/unresolved. BLOCKED if any contributing edge is BLOCKED (SCP/boundary deny on RunJobFlow or PassRole).

Narrative

{principal.name} can create a new EMR cluster (elasticmapreduce:RunJobFlow + iam:PassRole for service role and JobFlowRole {role.name}); the bootstrap actions and steps of that new cluster execute arbitrary code as {role.name}.

Raw rule rules/derived/aws/emr.yaml

id: aws-emr-execute-as-run-job-flow
emits: CanExecuteAs
description: Create a new EMR cluster with a privileged JobFlowRole via RunJobFlow + iam:PassRole; arbitrary
  bootstrap/step code executes as that role.
match:
- - principal: null
  - CanModifyCode
  - cluster: null
- - principal: null
  - CanPassIdentity
  - role: null
where:
- node_type(?cluster) == AnalyticsService
- ?cluster provider_type == AWS::EMR::Cluster
- CanModifyCode here is aws-emr-run-job-flow-code (RunJobFlow + PassRole for new cluster creation)
- CanPassIdentity here is aws-emr-pass-job-flow-role (PassRole for JobFlowRole instance profile)
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?role
  permissions:
  - elasticmapreduce:RunJobFlow
  - iam:PassRole
  conditions:
  - iam_permission
  - role_compatibility
  state_logic: "ACTIVE when the principal has EFFECTIVE RunJobFlow AND iam:PassRole for the ServiceRole\
    \ (elasticmapreduce.amazonaws.com) AND the JobFlowRole (ec2.amazonaws.com) \u2014 all iam:PassedToService\
    \ conditions satisfied. CONDITIONAL(role_compatibility) when PassedToService for either role is unknown/unresolved.\
    \ BLOCKED if any contributing edge is BLOCKED (SCP/boundary deny on RunJobFlow or PassRole)."
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - <CanModifyCode(aws-emr-run-job-flow-code) edge_id>
  - <CanPassIdentity(aws-emr-pass-job-flow-role) edge_id>
  false_positive_note: "Requires BOTH PassRole grants (ServiceRole for the EMR control plane AND JobFlowRole\
    \ for EC2 instance profile). Honor iam:PassedToService and role-ARN scope \u2014 a role passable only\
    \ to lambda.amazonaws.com cannot become a JobFlowRole. This is the create-then-execute path (more\
    \ infrastructure overhead than AddJobFlowSteps but does not require an existing cluster). The escalation\
    \ roll-up to CanEscalateTo is can-control escalate-via-execute-as \u2014 CITE, do not re-derive."
  narrative: '{principal.name} can create a new EMR cluster (elasticmapreduce:RunJobFlow + iam:PassRole
    for service role and JobFlowRole {role.name}); the bootstrap actions and steps of that new cluster
    execute arbitrary code as {role.name}.'