aws-emr-on-eks-start-job-code

id: aws-emr-on-eks-start-job-code
emits: CanModifyCode
description: emr-containers:StartJobRun lets a principal submit a Spark/Hive job with attacker-controlled
  application code on an EKS-hosted EMR virtual cluster.
match_effective_permission:
  action: emr-containers:StartJobRun
  resource_type: AWS::EMRContainers::VirtualCluster
where:
- principal has iam:PassRole for the executionRoleArn (emr-containers.amazonaws.com)
emit:
  source_type: Identity
  target_type: AnalyticsService
  source: <principal>
  target: <EMR on EKS Virtual Cluster (AnalyticsService)>
  permissions:
  - emr-containers:StartJobRun
  - iam:PassRole
  conditions:
  - iam_permission
  - role_compatibility
  false_positive_note: emr-containers:StartJobRun ALWAYS requires iam:PassRole for the executionRoleArn
    scoped to emr-containers.amazonaws.com. A principal without that PassRole grant cannot submit a job.
    Emit CONDITIONAL(role_compatibility) when the PassedToService condition or the role's EKS OIDC trust
    binding is unknown. The application code (entryPoint, scriptLocation) may reference an S3 object the
    principal controls; if the S3 path is attacker-writable this is CanModifyCode.
  narrative: '{principal.name} can submit an EMR on EKS job run with attacker-chosen application code
    (emr-containers:StartJobRun + iam:PassRole for executionRoleArn); the job executes as the passed execution
    role via the EKS pod identity binding.'