rage.fail

aws-lightsail-update-imds-options

derived aws emits CanModifyConfiguration

match (effective permission)

{ "action": "lightsail:UpdateInstanceMetadataOptions", "resource_type": "AWS::Lightsail::Instance" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<Lightsail instance in scope>`
permissions	`lightsail:UpdateInstanceMetadataOptions`

Narrative

{principal.name} can change the instance metadata options of {target.name} (lightsail:UpdateInstanceMetadataOptions), widening IMDS credential exposure.

Raw rule rules/derived/aws/lightsail.yaml

id: aws-lightsail-update-imds-options
emits: CanModifyConfiguration
match_effective_permission:
  action: lightsail:UpdateInstanceMetadataOptions
  resource_type: AWS::Lightsail::Instance
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <Lightsail instance in scope>
  permissions:
  - lightsail:UpdateInstanceMetadataOptions
  escalation: Re-enable IMDSv1 or raise the hop limit to widen exposure of the instance role's credentials.
  false_positive_note: Only meaningful for credential exposure when the instance has an associated IAM
    role. On its own it is a config change, not privilege gain.
  narrative: '{principal.name} can change the instance metadata options of {target.name} (lightsail:UpdateInstanceMetadataOptions),
    widening IMDS credential exposure.'