aws-lf-pass-role-to-lakeformation

id: aws-lf-pass-role-to-lakeformation
emits: CanPassIdentity
applies_to:
- aws
match_effective_permission:
  action: iam:PassRole
  resource_type: AWS::IAM::Role
where:
- PassedToService condition (if any) includes lakeformation.amazonaws.com (or condition is absent)
- '?role trust policy includes Principal: {Service: lakeformation.amazonaws.com}'
- 'principal also has at least one of: lakeformation:RegisterResource or lakeformation:UpdateResource'
emit:
  target_type: Role
  source_type: Identity
  source: <principal>
  target: <IAM Role node>
  permissions:
  - iam:PassRole
  conditions:
  - iam_permission
  - role_compatibility
  note: "Downgrade to POTENTIAL(role_compatibility) when the role trust policy does not explicitly include\
    \ lakeformation.amazonaws.com \u2014 LF cannot use the role and registration/update will fail. Honor\
    \ iam:PassedToService: a role passable only to glue.amazonaws.com or ec2.amazonaws.com does NOT satisfy\
    \ this gate."
  narrative: '{principal.name} can pass {role.name} to lakeformation.amazonaws.com (iam:PassRole); combined
    with lakeformation:RegisterResource or lakeformation:UpdateResource, this enables the Lake Formation
    PassRole privilege escalation path (derived rules aws-lf-register-resource-passrole and aws-lf-update-resource-config).'