aws-emr-run-job-flow-code
elasticmapreduce:RunJobFlow lets a principal create a new cluster with attacker-chosen bootstrap actions, AMI, and steps.
match (effective permission)
{
"action": "elasticmapreduce:RunJobFlow",
"resource_type": "AWS::EMR::Cluster"
}
where
principal also has iam:PassRole for the ServiceRole (elasticmapreduce.amazonaws.com) AND the JobFlowRole (ec2.amazonaws.com instance profile)
emit
| source type | Identity |
|---|---|
| target type | AnalyticsService |
| source | <principal> |
| target | <new EMR Cluster (AnalyticsService)> |
| permissions | elasticmapreduce:RunJobFlow iam:PassRole |
| conditions | iam_permission role_compatibility |
Narrative
{principal.name} can create a new EMR cluster (elasticmapreduce:RunJobFlow + iam:PassRole for service and instance roles), choosing the bootstrap actions, steps, and AMI - effectively injecting arbitrary code that runs at cluster launch.
Raw rule rules/derived/aws/emr.yaml
id: aws-emr-run-job-flow-code
emits: CanModifyCode
description: elasticmapreduce:RunJobFlow lets a principal create a new cluster with attacker-chosen bootstrap
actions, AMI, and steps.
match_effective_permission:
action: elasticmapreduce:RunJobFlow
resource_type: AWS::EMR::Cluster
where:
- principal also has iam:PassRole for the ServiceRole (elasticmapreduce.amazonaws.com) AND the JobFlowRole
(ec2.amazonaws.com instance profile)
emit:
source_type: Identity
target_type: AnalyticsService
source: <principal>
target: <new EMR Cluster (AnalyticsService)>
permissions:
- elasticmapreduce:RunJobFlow
- iam:PassRole
conditions:
- iam_permission
- role_compatibility
false_positive_note: 'Requires iam:PassRole for BOTH the ServiceRole (trust: elasticmapreduce.amazonaws.com)
AND the JobFlowRole / instance profile (trust: ec2.amazonaws.com). If either PassRole is denied or
iam:PassedToService excludes the relevant service principal, cluster creation fails -> emit CONDITIONAL(role_compatibility).
Model the CanPassIdentity edges for these roles separately (see below); this CanModifyCode rule reflects
the code-injection capability (bootstrap scripts, initial steps).'
narrative: "{principal.name} can create a new EMR cluster (elasticmapreduce:RunJobFlow + iam:PassRole\
\ for service and instance roles), choosing the bootstrap actions, steps, and AMI \u2014 effectively\
\ injecting arbitrary code that runs at cluster launch."