rage.fail

aws-lightsail-create-bucket-access-key

derived aws emits CanCreateCredentialFor

match (effective permission)

{ "action": "lightsail:CreateBucketAccessKey", "resource_type": "AWS::Lightsail::Bucket" }

emit

source type	`Identity`
source	`<principal>`
target	`<bucket access-key identity (AccessKey/ServiceIdentity for the bucket data plane)>`
permissions	`lightsail:CreateBucketAccessKey`

Narrative

{principal.name} can mint a bucket access key for {target.name} (lightsail:CreateBucketAccessKey) and authenticate as the bucket's data-plane identity.

Raw rule rules/derived/aws/lightsail.yaml

id: aws-lightsail-create-bucket-access-key
emits: CanCreateCredentialFor
match_effective_permission:
  action: lightsail:CreateBucketAccessKey
  resource_type: AWS::Lightsail::Bucket
emit:
  source_type: Identity
  source: <principal>
  target: <bucket access-key identity (AccessKey/ServiceIdentity for the bucket data plane)>
  permissions:
  - lightsail:CreateBucketAccessKey
  escalation: Mint a new long-lived bucket access key -> authenticate as the bucket's data-plane principal
    -> read/write bucket data from anywhere.
  false_positive_note: CanCreateCredentialFor targets an Identity, never the ObjectStorage resource itself.
    The minted key is a credential for a synthetic bucket access-key identity; the CredentialsFor edge
    (see aws-lightsail-bucket-access-key-credentials-for) links that identity to the bucket data.
  narrative: '{principal.name} can mint a bucket access key for {target.name} (lightsail:CreateBucketAccessKey)
    and authenticate as the bucket''s data-plane identity.'