aws-lf-update-resource-config

lakeformation:UpdateResource + iam:PassRole to lakeformation.amazonaws.com lets a principal swap the IAM role Lake Formation uses to vend temporary S3 credentials for a registered location, redirecting all subsequent data access through a role of the attacker's choosing.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'data_lake': None}

where

node_type(?data_lake) == DataLake ?data_lake.provider_type == 'AWS::LakeFormation::DataLake' ?principal has EFFECTIVE lakeformation:UpdateResource on resource '*' ?principal has EFFECTIVE iam:PassRole for a role trusted by lakeformation.amazonaws.com

emit

source type	`Identity`
target type	`DataLake`
source	`?principal`
target	`?data_lake`
permissions	`lakeformation:UpdateResource` `iam:PassRole (to lakeformation.amazonaws.com)`
conditions	`iam_permission` `role_compatibility` `scp_or_org_policy`
state logic	ACTIVE when BOTH lakeformation:UpdateResource (resource '*') AND iam:PassRole for a role whose trust policy allows lakeformation.amazonaws.com are confirmed EFFECTIVE for ?principal. CONDITIONAL(role_compatibility) when the role trust for lakeformation.amazonaws.com is unconfirmed (role may not admit LF as a trusted service — check trust policy before emitting ACTIVE). CONDITIONAL(iam_permission) when UpdateResource effective permission is unconfirmed. BLOCKED by an SCP denying lakeformation:UpdateResource or iam:PassRole for the target role. Inherit weakest from HasPermission contributor.

Narrative

{principal.name} has effective lakeformation:UpdateResource and can pass an IAM role to lakeformation.amazonaws.com (iam:PassRole). By updating a registered S3 location's associated role, {principal.name} causes Lake Formation to vend temporary credentials for the new role when analytics services access that location's data. Subsequent Glue/EMR/Athena queries against the location run with the new role's S3 and other IAM permissions.

Raw rule rules/derived/aws/lakeformation.yaml

id: aws-lf-update-resource-config
emits: CanModifyConfiguration
description: lakeformation:UpdateResource + iam:PassRole to lakeformation.amazonaws.com lets a principal
  swap the IAM role Lake Formation uses to vend temporary S3 credentials for a registered location, redirecting
  all subsequent data access through a role of the attacker's choosing.
match:
- - principal: null
  - HasPermission
  - data_lake: null
where:
- node_type(?data_lake) == DataLake
- ?data_lake.provider_type == 'AWS::LakeFormation::DataLake'
- ?principal has EFFECTIVE lakeformation:UpdateResource on resource '*'
- ?principal has EFFECTIVE iam:PassRole for a role trusted by lakeformation.amazonaws.com
emit:
  source_type: Identity
  target_type: DataLake
  source: ?principal
  target: ?data_lake
  permissions:
  - lakeformation:UpdateResource
  - iam:PassRole (to lakeformation.amazonaws.com)
  conditions:
  - iam_permission
  - role_compatibility
  - scp_or_org_policy
  state_logic: "ACTIVE when BOTH lakeformation:UpdateResource (resource '*') AND iam:PassRole for a role\
    \ whose trust policy allows lakeformation.amazonaws.com are confirmed EFFECTIVE for ?principal. CONDITIONAL(role_compatibility)\
    \ when the role trust for lakeformation.amazonaws.com is unconfirmed (role may not admit LF as a trusted\
    \ service \u2014 check trust policy before emitting ACTIVE). CONDITIONAL(iam_permission) when UpdateResource\
    \ effective permission is unconfirmed. BLOCKED by an SCP denying lakeformation:UpdateResource or iam:PassRole\
    \ for the target role. Inherit weakest from HasPermission contributor."
  confidence: min(contributing_confidences) * 0.90
  derived_from:
  - ?principal HasPermission ?data_lake (lakeformation:UpdateResource effective)
  - ?principal HasPermission role (iam:PassRole to lakeformation.amazonaws.com effective)
  - "can-execute-as:execute-as-via-config-identity-swap (downstream CanExecuteAs \u2014 cited not re-derived)"
  false_positive_note: "Two permissions required: lakeformation:UpdateResource AND iam:PassRole scoped\
    \ to lakeformation.amazonaws.com. If iam:PassRole has an iam:PassedToService condition that excludes\
    \ lakeformation.amazonaws.com, the role swap will fail. The privilege escalation consequence is that\
    \ subsequent analytics service calls to that location use the new role's credentials \u2014 this is\
    \ a DATA ACCESS change, not a control-plane role assumption. The attacker's code does not run as the\
    \ new role; the ANALYTICS SERVICE executes as the new role when vending credentials. can-execute-as\
    \ execute-as-via-config-identity-swap collapses this into CanExecuteAs if the attacker can also trigger\
    \ a Glue/EMR job against the location \u2014 cite, do not re-derive."
  narrative: '{principal.name} has effective lakeformation:UpdateResource and can pass an IAM role to
    lakeformation.amazonaws.com (iam:PassRole). By updating a registered S3 location''s associated role,
    {principal.name} causes Lake Formation to vend temporary credentials for the new role when analytics
    services access that location''s data. Subsequent Glue/EMR/Athena queries against the location run
    with the new role''s S3 and other IAM permissions.'