aws-lambda-attach-role-via-config

Swap an existing function's execution role via UpdateFunctionConfiguration.

derived aws emits CanAttachIdentity

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Compute`
source	`?principal`
target	`?function`
permissions	`lambda:UpdateFunctionConfiguration` `iam:PassRole`
conditions	`role_compatibility` `iam_permission`
state logic	if ?role trust policy or iam:PassedToService is unknown/unresolved: POTENTIAL(role_compatibility); else ACTIVE for the attach capability itself (downstream execution still needs a run path — see note)

source type

Identity

target type

Compute

source

?principal

target

?function

permissions

lambda:UpdateFunctionConfiguration iam:PassRole

conditions

role_compatibility iam_permission

state logic

if ?role trust policy or iam:PassedToService is unknown/unresolved: POTENTIAL(role_compatibility); else ACTIVE for the attach capability itself (downstream execution still needs a run path — see note)

Narrative

{principal.name} can re-point {function.name} to run as {role.name} (lambda:UpdateFunctionConfiguration + iam:PassRole to lambda).

Raw rule rules/derived/aws/lambda.yaml

id: aws-lambda-attach-role-via-config
emits: CanAttachIdentity
description: Swap an existing function's execution role via UpdateFunctionConfiguration.
match:
- - principal: null
  - CanModifyConfiguration
  - function: null
- - principal: null
  - CanPassIdentity
  - role: null
where:
- node_type(?function) == ServerlessFunction
- ?role trust policy allows lambda.amazonaws.com
- iam:PassRole for ?role permits iam:PassedToService including lambda.amazonaws.com
emit:
  source_type: Identity
  target_type: Compute
  source: ?principal
  target: ?function
  permissions:
  - lambda:UpdateFunctionConfiguration
  - iam:PassRole
  conditions:
  - role_compatibility
  - iam_permission
  state_logic: "if ?role trust policy or iam:PassedToService is unknown/unresolved: POTENTIAL(role_compatibility);\
    \ else ACTIVE for the attach capability itself (downstream execution still needs a run path \u2014\
    \ see note)"
  derived_from:
  - <CanModifyConfiguration edge_id>
  - <CanPassIdentity edge_id>
  false_positive_note: 'Requires iam:PassRole for the NEW role scoped to lambda.amazonaws.com; when the
    new role''s trust or iam:PassedToService is unknown, downgrade to POTENTIAL(role_compatibility). The
    attach capability itself is ACTIVE once trust/PassedToService admit lambda, but re-pointing the role
    only yields privilege once the function actually runs: this edge chains to CanExecuteAs(new role)
    via aws-lambda-execute-as-via-config-injection only after the role is attached AND a run path (direct
    invoke or existing/creatable trigger) exists.'
  narrative: '{principal.name} can re-point {function.name} to run as {role.name} (lambda:UpdateFunctionConfiguration
    + iam:PassRole to lambda).'