rage.fail

aws-lightsail-download-keypair

derived aws emits CanReadCredential

match (effective permission)

{ "action": "lightsail:DownloadDefaultKeyPair", "resource_type": "AWS::Lightsail::KeyPair" }

emit

source	`<principal>`
target	`<default SSH key pair>`
permissions	`lightsail:DownloadDefaultKeyPair`
conditions	`network_reachability` `service_state`
state logic	ACTIVE for the credential read itself; the onward OS-access escalation is CONDITIONAL(network_reachability, service_state) and only realizes against an instance actually launched with the default key pair and reachable on SSH.

Narrative

{principal.name} can download the default SSH private key (lightsail:DownloadDefaultKeyPair), enabling OS access to instances launched with it and reachable on SSH.

Raw rule rules/derived/aws/lightsail.yaml

id: aws-lightsail-download-keypair
emits: CanReadCredential
match_effective_permission:
  action: lightsail:DownloadDefaultKeyPair
  resource_type: AWS::Lightsail::KeyPair
emit:
  source: <principal>
  target: <default SSH key pair>
  permissions:
  - lightsail:DownloadDefaultKeyPair
  conditions:
  - network_reachability
  - service_state
  state_logic: ACTIVE for the credential read itself; the onward OS-access escalation is CONDITIONAL(network_reachability,
    service_state) and only realizes against an instance actually launched with the default key pair and
    reachable on SSH.
  escalation: Retrieve the account default SSH private key -> SSH into any instance launched with it (only
    if such an instance exists and is reachable).
  false_positive_note: Yields the default SSH private key only; usable for OS access only against instances
    actually launched with the default key pair and reachable on SSH. Absent such an instance this is
    credential material with no reachable target.
  narrative: '{principal.name} can download the default SSH private key (lightsail:DownloadDefaultKeyPair),
    enabling OS access to instances launched with it and reachable on SSH.'