rage.fail

aws-lightsail-execute-as-via-instance-imds

OS access to a Lightsail instance -> read IMDS -> act as the associated role.

derived aws emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanExecuteCommand {'instance': None} {'instance': None} ExecutesAs {'role': None}

where

node_type(?instance) == VirtualMachine provider_type(?instance) == 'AWS::Lightsail::Instance' IMDS reachable from the OS session

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<associated IAM role>`
permissions	`lightsail:GetInstanceAccessDetails`
conditions	`service_state` `network_reachability`

Narrative

{principal.name} can execute as {role.name} by getting OS access to {instance.name} and reading its instance metadata credentials.

Raw rule rules/derived/aws/lightsail.yaml

id: aws-lightsail-execute-as-via-instance-imds
emits: CanExecuteAs
description: OS access to a Lightsail instance -> read IMDS -> act as the associated role.
match:
- - principal: null
  - CanExecuteCommand
  - instance: null
- - instance: null
  - ExecutesAs
  - role: null
where:
- node_type(?instance) == VirtualMachine
- provider_type(?instance) == 'AWS::Lightsail::Instance'
- IMDS reachable from the OS session
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <associated IAM role>
  permissions:
  - lightsail:GetInstanceAccessDetails
  conditions:
  - service_state
  - network_reachability
  escalation: SSH into the instance, read IMDS, and use the associated role's session credentials.
  false_positive_note: Requires an IAM role to be associated with the instance AND IMDS reachable. Absent
    an associated role, this yields OS control only, not AWS privilege escalation.
  narrative: '{principal.name} can execute as {role.name} by getting OS access to {instance.name} and
    reading its instance metadata credentials.'