aws-lambda-create-workload-as

Create a new Lambda bound to any role passable to lambda, then invoke it.

derived aws emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`?role`
permissions	`iam:PassRole` `lambda:CreateFunction` `lambda:InvokeFunction?`
conditions	`role_compatibility` `iam_permission`
state logic	if ?role trust policy or iam:PassedToService is unknown/unresolved: POTENTIAL(role_compatibility); elif principal also has lambda:InvokeFunction on the new function: ACTIVE; else CONDITIONAL(trigger_exists)

source type

Identity

target type

Identity

source

?principal

target

?role

permissions

iam:PassRole lambda:CreateFunction lambda:InvokeFunction?

conditions

role_compatibility iam_permission

state logic

if ?role trust policy or iam:PassedToService is unknown/unresolved: POTENTIAL(role_compatibility); elif principal also has lambda:InvokeFunction on the new function: ACTIVE; else CONDITIONAL(trigger_exists)

Narrative

{principal.name} can pass {role.name} to Lambda and create a function (iam:PassRole + lambda:CreateFunction), then invoke it to execute code as {role.name}.

Raw rule rules/derived/aws/lambda.yaml

id: aws-lambda-create-workload-as
emits: CanCreateWorkloadAs
description: Create a new Lambda bound to any role passable to lambda, then invoke it.
match:
- - principal: null
  - CanPassIdentity
  - role: null
where:
- ?principal has EFFECTIVE lambda:CreateFunction (resource scope covers the new function)
- ?role trust policy allows lambda.amazonaws.com
- iam:PassRole for ?role permits iam:PassedToService including lambda.amazonaws.com (or unconditioned)
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?role
  permissions:
  - iam:PassRole
  - lambda:CreateFunction
  - lambda:InvokeFunction?
  conditions:
  - role_compatibility
  - iam_permission
  state_logic: 'if ?role trust policy or iam:PassedToService is unknown/unresolved: POTENTIAL(role_compatibility);
    elif principal also has lambda:InvokeFunction on the new function: ACTIVE; else CONDITIONAL(trigger_exists)'
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - <CanPassIdentity edge_id>
  note: "Modeling consistency: the schema canonical_derivation for CanCreateWorkloadAs is CanDeploy +\
    \ CanPassIdentity + role_compatible. This rule intentionally folds lambda:CreateFunction (checked\
    \ in the where-clause) directly as the CanDeploy-equivalent for Lambda rather than emitting a separate\
    \ CanDeploy edge; no CanDeploy(principal -> Lambda platform) edge exists in the Lambda explicit rules,\
    \ so graph consumers keying strictly off CanDeploy will not see this path. No permission is hallucinated\
    \ \u2014 this is a deliberate CreateFunction~CanDeploy fold."
  false_positive_note: 'Honor iam:PassedToService: a role passable only to ec2/ecs does NOT yield Lambda
    execution. The role MUST trust lambda.amazonaws.com or CreateFunction fails -> downgrade to POTENTIAL
    when trust is unknown.'
  narrative: '{principal.name} can pass {role.name} to Lambda and create a function (iam:PassRole + lambda:CreateFunction),
    then invoke it to execute code as {role.name}.'