rage.fail

aws-execute-as-via-passrole

PassRole + ability to create/run a compute resource that accepts the role.

derived aws emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanPassIdentity {'role': None}

where

?principal has an EFFECTIVE create/run action for a service S in {lambda:CreateFunction, ec2:RunInstances, ecs:RunTask, glue:CreateJob/StartJobRun, cloudformation:CreateStack, datapipeline:*, sagemaker:CreateNotebookInstance, codebuild:CreateProject, ssm automation} role trust allows service S (service-linked assume) AND PassedToService condition (if any) includes S

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<IAM role>`
permissions	`iam:PassRole` `<service create/run action>`

Narrative

{principal.name} can pass {role.name} to {service} and create/run a workload there, executing code as {role.name}.

Raw rule rules/derived/aws/identity-escalation.yaml

id: aws-execute-as-via-passrole
emits: CanExecuteAs
description: PassRole + ability to create/run a compute resource that accepts the role.
match:
- - principal: null
  - CanPassIdentity
  - role: null
where:
- ?principal has an EFFECTIVE create/run action for a service S in {lambda:CreateFunction, ec2:RunInstances,
  ecs:RunTask, glue:CreateJob/StartJobRun, cloudformation:CreateStack, datapipeline:*, sagemaker:CreateNotebookInstance,
  codebuild:CreateProject, ssm automation}
- role trust allows service S (service-linked assume) AND PassedToService condition (if any) includes
  S
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <IAM role>
  permissions:
  - iam:PassRole
  - <service create/run action>
  escalation: Create a workload bound to a privileged role and execute code as it.
  narrative: '{principal.name} can pass {role.name} to {service} and create/run a workload there, executing
    code as {role.name}.'