rage.fail

aws-lambda-escalate-to-role

Executing as a more-privileged Lambda role is privilege escalation.

derived aws emits CanEscalateTo

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanExecuteAs {'role': None}

where

?role.privilege_level > ?principal.privilege_level

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`?role`

Narrative

{principal.name} can escalate to {role.name} by executing code in a Lambda function that runs as it.

Raw rule rules/derived/aws/lambda.yaml

id: aws-lambda-escalate-to-role
emits: CanEscalateTo
description: Executing as a more-privileged Lambda role is privilege escalation.
match:
- - principal: null
  - CanExecuteAs
  - role: null
where:
- ?role.privilege_level > ?principal.privilege_level
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?role
  permissions: []
  derived_from:
  - <CanExecuteAs edge_id>
  false_positive_note: Only emit when the execution role is strictly more privileged than the caller;
    a lateral same-privilege role is not escalation. Inherits state from CanExecuteAs.
  narrative: '{principal.name} can escalate to {role.name} by executing code in a Lambda function that
    runs as it.'