rage.fail

aws-lambda-retrieve-exec-role-token

Code running as the function can fetch the execution-role token.

derived aws emits CanRetrieveToken

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanExecuteAs {'role': None}

where

?role is a Lambda execution role (reached via a Lambda CanExecuteAs rule)

emit

source	`?principal`
target	`?role`

Narrative

{principal.name}, executing as {role.name} in Lambda, can retrieve the execution-role session token from the runtime credential endpoint.

Raw rule rules/derived/aws/lambda.yaml

id: aws-lambda-retrieve-exec-role-token
emits: CanRetrieveToken
description: Code running as the function can fetch the execution-role token.
match:
- - principal: null
  - CanExecuteAs
  - role: null
where:
- ?role is a Lambda execution role (reached via a Lambda CanExecuteAs rule)
emit:
  source: ?principal
  target: ?role
  permissions: []
  derived_from:
  - <CanExecuteAs edge_id>
  false_positive_note: Redundant with CanExecuteAs for path-finding; emitted so credential-centric queries
    surface the token-retrieval step. Same state as its CanExecuteAs input.
  narrative: '{principal.name}, executing as {role.name} in Lambda, can retrieve the execution-role session
    token from the runtime credential endpoint.'