rage.fail

aws-lightsail-instance-access-ssh

derived aws emits CanExecuteCommand

match (effective permission)

{ "action": "lightsail:GetInstanceAccessDetails", "resource_type": "AWS::Lightsail::Instance" }

emit

source type	`Identity`
source	`<principal>`
target	`<Lightsail instance in scope>`
permissions	`lightsail:GetInstanceAccessDetails`
conditions	`network_reachability` `service_state`
state logic	ACTIVE if instance running and reachable on SSH/RDP else CONDITIONAL(network_reachability, service_state)

Narrative

{principal.name} can obtain temporary SSH/RDP credentials for instance {target.name} (lightsail:GetInstanceAccessDetails) and run OS commands.

Raw rule rules/derived/aws/lightsail.yaml

id: aws-lightsail-instance-access-ssh
emits: CanExecuteCommand
match_effective_permission:
  action: lightsail:GetInstanceAccessDetails
  resource_type: AWS::Lightsail::Instance
emit:
  source_type: Identity
  source: <principal>
  target: <Lightsail instance in scope>
  permissions:
  - lightsail:GetInstanceAccessDetails
  conditions:
  - network_reachability
  - service_state
  state_logic: ACTIVE if instance running and reachable on SSH/RDP else CONDITIONAL(network_reachability,
    service_state)
  false_positive_note: Yields OS-level access, not AWS credentials directly. AWS escalation only completes
    if the instance IMDS exposes an associated IAM role (see aws-lightsail-execute-as-via-instance-imds).
  narrative: '{principal.name} can obtain temporary SSH/RDP credentials for instance {target.name} (lightsail:GetInstanceAccessDetails)
    and run OS commands.'