aws-msk-connect-executes-as

id: aws-msk-connect-executes-as
emits: ExecutesAs
description: An MSK Connect connector runs its plugin code as the configured IAM service execution role.
match_record:
  resource_type: AWS::MSKConnect::Connector
  field: serviceExecutionRoleArn
where:
- connector.serviceExecutionRoleArn is non-empty (all valid MSK Connect connectors have a service execution
  role)
emit:
  source_type: GenericCompute
  target_type: MachineIdentity
  source: <MSK Connect Connector (GenericCompute)>
  target: <IAM role from connector.serviceExecutionRoleArn>
  state: ACTIVE
  conditions:
  - service_state
  permissions: []
  derived_from:
  - AWS::MSKConnect::Connector.serviceExecutionRoleArn (kafkaconnect:DescribeConnector)
  false_positive_note: Every MSK Connect connector must have exactly one serviceExecutionRoleArn set at
    creation time; it cannot be changed after creation (UpdateConnector does not accept a new serviceExecutionRoleArn).
    Emit this edge for every connector regardless of its running state. The role is bound at create time
    via iam:PassRole to kafkaconnect.amazonaws.com; the connector trust policy must list kafkaconnect.amazonaws.com.
    Verify the role's trust policy allows kafkaconnect.amazonaws.com before emitting ACTIVE (otherwise
    downgrade to CONDITIONAL(role_compatibility)).
  narrative: MSK Connect connector {connector.name} runs all plugin tasks as IAM role {role.name} (connector.serviceExecutionRoleArn).
    Code executing within the connector has {role.name}'s AWS credentials via the ECS container-credential
    endpoint.