rage.fail

aws-lightsail-container-deploy-code

derived aws emits CanModifyCode

match (effective permission)

{ "action": "lightsail:CreateContainerServiceDeployment", "resource_type": "AWS::Lightsail::Container" }

emit

source type	`Identity`
source	`<principal>`
target	`<container service in scope>`
permissions	`lightsail:CreateContainerServiceDeployment` `lightsail:RegisterContainerImage?`

Narrative

{principal.name} can deploy an arbitrary image + command to container service {target.name} (lightsail:CreateContainerServiceDeployment).

Raw rule rules/derived/aws/lightsail.yaml

id: aws-lightsail-container-deploy-code
emits: CanModifyCode
match_effective_permission:
  action: lightsail:CreateContainerServiceDeployment
  resource_type: AWS::Lightsail::Container
optional_permission: lightsail:RegisterContainerImage
emit:
  source_type: Identity
  source: <principal>
  target: <container service in scope>
  permissions:
  - lightsail:CreateContainerServiceDeployment
  - lightsail:RegisterContainerImage?
  escalation: Deploy an arbitrary container image with an attacker-chosen launch command and env -> code
    execution on the container service.
  narrative: '{principal.name} can deploy an arbitrary image + command to container service {target.name}
    (lightsail:CreateContainerServiceDeployment).'