aws-glue-create-session-execute-as

Create an interactive Glue Session bound to a passable role, then execute code inline via RunStatement to run as that role.

derived aws emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanPassIdentity {'role': None}

where

?principal has EFFECTIVE glue:CreateSession (resource scope covers new session in target account/region) ?principal has EFFECTIVE glue:RunStatement (or implied by CreateSession on same session) ?role trust policy allows glue.amazonaws.com as a service principal (or trust is unresolved) iam:PassRole for ?role permits iam:PassedToService including glue.amazonaws.com (or unconditioned)

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`?role`
permissions	`glue:CreateSession` `iam:PassRole` `glue:RunStatement`
conditions	`iam_permission` `role_compatibility` `condition_expression`
state logic	if ?role trust policy or iam:PassedToService is unknown/unresolved: POTENTIAL(role_compatibility). Elif principal has glue:CreateSession AND glue:RunStatement AND iam:PassRole to glue.amazonaws.com is confirmed: ACTIVE (the session is spun up and code runs immediately inline, no trigger gate needed). Else CONDITIONAL(iam_permission, role_compatibility) when one of the required actions is present but not fully confirmed.

Narrative

{principal.name} can create an interactive Glue Session (glue:CreateSession) bound to {role.name} (iam:PassRole to glue.amazonaws.com), then run arbitrary Python/Spark code inline (glue:RunStatement) to execute as {role.name}.

Raw rule rules/derived/aws/glue.yaml

id: aws-glue-create-session-execute-as
emits: CanCreateWorkloadAs
description: Create an interactive Glue Session bound to a passable role, then execute code inline via
  RunStatement to run as that role.
applies_to:
- aws
match:
- - principal: null
  - CanPassIdentity
  - role: null
where:
- ?principal has EFFECTIVE glue:CreateSession (resource scope covers new session in target account/region)
- ?principal has EFFECTIVE glue:RunStatement (or implied by CreateSession on same session)
- ?role trust policy allows glue.amazonaws.com as a service principal (or trust is unresolved)
- iam:PassRole for ?role permits iam:PassedToService including glue.amazonaws.com (or unconditioned)
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?role
  permissions:
  - glue:CreateSession
  - iam:PassRole
  - glue:RunStatement
  conditions:
  - iam_permission
  - role_compatibility
  - condition_expression
  state_logic: 'if ?role trust policy or iam:PassedToService is unknown/unresolved: POTENTIAL(role_compatibility).
    Elif principal has glue:CreateSession AND glue:RunStatement AND iam:PassRole to glue.amazonaws.com
    is confirmed: ACTIVE (the session is spun up and code runs immediately inline, no trigger gate needed).
    Else CONDITIONAL(iam_permission, role_compatibility) when one of the required actions is present but
    not fully confirmed.'
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - <CanPassIdentity(principal, role) edge_id>
  false_positive_note: "Honor iam:PassedToService: a role passable only to ec2.amazonaws.com / ecs-tasks.amazonaws.com\
    \ does NOT yield Glue execution. The role MUST trust glue.amazonaws.com or CreateSession fails (downgrade\
    \ to POTENTIAL when trust is unknown). glue:RunStatement is the execution trigger \u2014 it is synchronous\
    \ and does not require an EventBridge rule or Glue Trigger. This rule emits CanCreateWorkloadAs; can-execute-as\
    \ execute-as-via-new-workload linchpin derives CanExecuteAs(principal -> role). Do not emit CanExecuteAs\
    \ directly here \u2014 cite can-execute-as."
  narrative: '{principal.name} can create an interactive Glue Session (glue:CreateSession) bound to {role.name}
    (iam:PassRole to glue.amazonaws.com), then run arbitrary Python/Spark code inline (glue:RunStatement)
    to execute as {role.name}.'