aws-msk-connect-create-workload-as
Creating a new MSK Connect connector bound to a passable execution role is CanCreateWorkloadAs: code in the connector runs as that role.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?principal has EFFECTIVE kafkaconnect:CreateConnector
?role trust policy allows kafkaconnect.amazonaws.com (or unknown/unresolved — POTENTIAL)
iam:PassRole for ?role admits kafkaconnect.amazonaws.com (or unconditioned)
emit
| source type | Identity |
|---|---|
| target type | MachineIdentity |
| source | ?principal |
| target | ?role |
| permissions | iam:PassRole kafkaconnect:CreateConnector |
| conditions | iam_permission role_compatibility |
| state logic | ACTIVE when ?role trust policy allows kafkaconnect.amazonaws.com AND principal has effective kafkaconnect:CreateConnector AND iam:PassRole admits kafkaconnect.amazonaws.com. POTENTIAL(role_compatibility) when the role trust is unknown/unresolved — the connector will fail to start if the role does not trust kafkaconnect.amazonaws.com. BLOCKED if PassedToService explicitly excludes kafkaconnect.amazonaws.com or SCP denies iam:PassRole or kafkaconnect:CreateConnector. |
Narrative
{principal.name} can create a new MSK Connect connector bound to {role.name} (iam:PassRole + kafkaconnect:CreateConnector). Plugin code running in the connector executes as {role.name}, reaching any service that role's permissions cover.
Raw rule rules/derived/aws/msk.yaml
id: aws-msk-connect-create-workload-as
emits: CanCreateWorkloadAs
description: 'Creating a new MSK Connect connector bound to a passable execution role is CanCreateWorkloadAs:
code in the connector runs as that role.'
match:
- - principal: null
- CanPassIdentity
- role: null
where:
- ?principal has EFFECTIVE kafkaconnect:CreateConnector
- "?role trust policy allows kafkaconnect.amazonaws.com (or unknown/unresolved \u2014 POTENTIAL)"
- iam:PassRole for ?role admits kafkaconnect.amazonaws.com (or unconditioned)
emit:
source_type: Identity
target_type: MachineIdentity
source: ?principal
target: ?role
permissions:
- iam:PassRole
- kafkaconnect:CreateConnector
conditions:
- iam_permission
- role_compatibility
state_logic: "ACTIVE when ?role trust policy allows kafkaconnect.amazonaws.com AND principal has effective\
\ kafkaconnect:CreateConnector AND iam:PassRole admits kafkaconnect.amazonaws.com. POTENTIAL(role_compatibility)\
\ when the role trust is unknown/unresolved \u2014 the connector will fail to start if the role does\
\ not trust kafkaconnect.amazonaws.com. BLOCKED if PassedToService explicitly excludes kafkaconnect.amazonaws.com\
\ or SCP denies iam:PassRole or kafkaconnect:CreateConnector."
confidence: min(contributing_confidences) * 0.95
derived_from:
- ?principal CanPassIdentity ?role (aws-msk-connect-pass-role)
- kafkaconnect:CreateConnector check
false_positive_note: "Honor iam:PassedToService and the role trust policy. A role passable only to ec2.amazonaws.com\
\ or lambda.amazonaws.com cannot be bound to MSK Connect. CanCreateWorkloadAs captures the create+bind\
\ capability; the full CanExecuteAs derivation is handled by can-execute-as.execute-as-via-new-workload\
\ once this edge is present \u2014 cite, do not re-derive. Also requires creating a valid connector\
\ configuration (plugin ARN, Kafka bootstrap servers, etc.) \u2014 not a one-permission escalation,\
\ but the iam:PassRole + CreateConnector pair is the binding gate."
narrative: '{principal.name} can create a new MSK Connect connector bound to {role.name} (iam:PassRole
+ kafkaconnect:CreateConnector). Plugin code running in the connector executes as {role.name}, reaching
any service that role''s permissions cover.'