aws-emr-serverless-start-job-code

id: aws-emr-serverless-start-job-code
emits: CanModifyCode
description: emr-serverless:StartJobRun lets a principal submit a Spark/Hive job with attacker-controlled
  application code.
match_effective_permission:
  action: emr-serverless:StartJobRun
  resource_type: AWS::EMRServerless::Application
where:
- principal has iam:PassRole for the executionRoleArn (emr-serverless.amazonaws.com)
emit:
  source_type: Identity
  target_type: AnalyticsService
  source: <principal>
  target: <EMR Serverless Application (AnalyticsService)>
  permissions:
  - emr-serverless:StartJobRun
  - iam:PassRole
  conditions:
  - iam_permission
  - role_compatibility
  false_positive_note: emr-serverless:StartJobRun ALWAYS requires iam:PassRole for the executionRoleArn
    scoped to emr-serverless.amazonaws.com. A principal without that PassRole grant cannot submit a job.
    Emit CONDITIONAL(role_compatibility) when the PassedToService condition or ARN scope for the execution
    role is unknown. The application code (entryPoint, scriptLocation) may reference an S3 object the
    principal controls; if the S3 path is attacker-writable this is CanModifyCode; if the attacker provides
    an inline/external script URI, same effect.
  narrative: '{principal.name} can submit an EMR Serverless job run with attacker-chosen application code
    (emr-serverless:StartJobRun + iam:PassRole for executionRoleArn); the job executes as the passed execution
    role.'