rage.fail

aws-lightsail-execute-as-container

Arbitrary container deployment runs as the Lightsail-managed service execution context.

derived aws emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanModifyCode {'containerservice': None} {'containerservice': None} ExecutesAs {'serviceidentity': None}

where

node_type(?containerservice) == ContainerService node_type(?serviceidentity) == ServiceIdentity

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<Lightsail-managed ServiceIdentity>`
permissions	`lightsail:CreateContainerServiceDeployment`
state logic	ACTIVE (deployment executes immediately)

Narrative

{principal.name} executes code as {target.name} by deploying an arbitrary container to {containerservice.name}.

Raw rule rules/derived/aws/lightsail.yaml

id: aws-lightsail-execute-as-container
emits: CanExecuteAs
description: Arbitrary container deployment runs as the Lightsail-managed service execution context.
match:
- - principal: null
  - CanModifyCode
  - containerservice: null
- - containerservice: null
  - ExecutesAs
  - serviceidentity: null
where:
- node_type(?containerservice) == ContainerService
- node_type(?serviceidentity) == ServiceIdentity
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <Lightsail-managed ServiceIdentity>
  permissions:
  - lightsail:CreateContainerServiceDeployment
  state_logic: ACTIVE (deployment executes immediately)
  false_positive_note: The container-service execution context is a narrow Lightsail-managed ServiceIdentity,
    NOT a customer-chosen IAM role. Do not equate its reach to a full account role or emit CanEnterAccount
    from it unless collection proves broad permissions.
  narrative: '{principal.name} executes code as {target.name} by deploying an arbitrary container to {containerservice.name}.'