aws-imagebuilder-create-pipeline-with-role

Create a new image pipeline with an infrastructure configuration that uses a passable IAM role as its instance profile, then trigger a build to execute as that role.

derived aws emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanPassIdentity {'role': None}

where

?principal has effective imagebuilder:CreateInfrastructureConfiguration (resource scope covers new configs) ?principal has effective imagebuilder:CreateImagePipeline (resource scope covers new pipelines) ?principal has effective imagebuilder:CreateComponent OR imagebuilder:CreateImageRecipe (to supply a definition) ?principal has effective imagebuilder:StartImagePipelineExecution (to trigger the new pipeline) ?role trust policy allows ec2.amazonaws.com (or trust is unknown) iam:PassedToService condition (if any) does not restrict to a service that excludes ec2.amazonaws.com

emit

source type	`Identity`
target type	`MachineIdentity`
source	`?principal`
target	`?role`
permissions	`imagebuilder:CreateInfrastructureConfiguration` `imagebuilder:CreateImagePipeline` `imagebuilder:CreateComponent` `imagebuilder:CreateImageRecipe` `imagebuilder:StartImagePipelineExecution` `iam:PassRole`
conditions	`role_compatibility` `iam_permission`
state logic	ACTIVE when all creation actions are available as effective permissions AND ?role trusts ec2.amazonaws.com (role_compatibility satisfied). CONDITIONAL(role_compatibility) when the role trust policy or PassedToService condition does not clearly admit ec2.amazonaws.com — the pipeline creation may succeed but the instance launch will fail at the IAM assume step. POTENTIAL when the creation permissions or role compatibility are uncertain. BLOCKED when an SCP or boundary denies any of the creation actions or iam:PassRole. can-execute-as execute-as-via-new-workload rolls this up to CanExecuteAs(role) — cited, not re-derived here.

Narrative

{principal.name} can create a new Image Builder pipeline with an infrastructure configuration that assigns {role.name} as the instance profile (imagebuilder:CreateInfrastructureConfiguration + iam:PassRole), then trigger a build (imagebuilder:StartImagePipelineExecution) to execute attacker-authored component steps as {role.name}.

Raw rule rules/derived/aws/imagebuilder.yaml

id: aws-imagebuilder-create-pipeline-with-role
emits: CanCreateWorkloadAs
description: Create a new image pipeline with an infrastructure configuration that uses a passable IAM
  role as its instance profile, then trigger a build to execute as that role.
match:
- - principal: null
  - CanPassIdentity
  - role: null
where:
- ?principal has effective imagebuilder:CreateInfrastructureConfiguration (resource scope covers new configs)
- ?principal has effective imagebuilder:CreateImagePipeline (resource scope covers new pipelines)
- ?principal has effective imagebuilder:CreateComponent OR imagebuilder:CreateImageRecipe (to supply a
  definition)
- ?principal has effective imagebuilder:StartImagePipelineExecution (to trigger the new pipeline)
- ?role trust policy allows ec2.amazonaws.com (or trust is unknown)
- iam:PassedToService condition (if any) does not restrict to a service that excludes ec2.amazonaws.com
emit:
  source_type: Identity
  target_type: MachineIdentity
  source: ?principal
  target: ?role
  permissions:
  - imagebuilder:CreateInfrastructureConfiguration
  - imagebuilder:CreateImagePipeline
  - imagebuilder:CreateComponent
  - imagebuilder:CreateImageRecipe
  - imagebuilder:StartImagePipelineExecution
  - iam:PassRole
  conditions:
  - role_compatibility
  - iam_permission
  state_logic: "ACTIVE when all creation actions are available as effective permissions AND ?role trusts\
    \ ec2.amazonaws.com (role_compatibility satisfied). CONDITIONAL(role_compatibility) when the role\
    \ trust policy or PassedToService condition does not clearly admit ec2.amazonaws.com \u2014 the pipeline\
    \ creation may succeed but the instance launch will fail at the IAM assume step. POTENTIAL when the\
    \ creation permissions or role compatibility are uncertain. BLOCKED when an SCP or boundary denies\
    \ any of the creation actions or iam:PassRole. can-execute-as execute-as-via-new-workload rolls this\
    \ up to CanExecuteAs(role) \u2014 cited, not re-derived here."
  confidence: min(contributing_confidences) * 0.88
  derived_from:
  - ?principal CanPassIdentity ?role (iam:PassRole)
  - effective_permission(?principal, imagebuilder:CreateInfrastructureConfiguration)
  - effective_permission(?principal, imagebuilder:CreateImagePipeline)
  - effective_permission(?principal, imagebuilder:StartImagePipelineExecution)
  - can-execute-as execute-as-via-new-workload (cited)
  false_positive_note: "All five creation actions must be available; missing any of them means the pipeline\
    \ cannot be stood up. Verify resource scope \u2014 a principal whose CreateImagePipeline is scoped\
    \ to a specific ARN prefix that would not match the newly created pipeline ARN must be treated as\
    \ POTENTIAL. The role_compatibility check on ec2.amazonaws.com trust is critical; without it the instance\
    \ profile assignment fails at launch time. Do not emit ACTIVE when the role trust is unknown \u2014\
    \ use CONDITIONAL(role_compatibility)."
  narrative: '{principal.name} can create a new Image Builder pipeline with an infrastructure configuration
    that assigns {role.name} as the instance profile (imagebuilder:CreateInfrastructureConfiguration +
    iam:PassRole), then trigger a build (imagebuilder:StartImagePipelineExecution) to execute attacker-authored
    component steps as {role.name}.'