aws-msk-connect-pass-role
iam:PassRole to kafkaconnect.amazonaws.com allows the principal to bind any passable role to an MSK Connect connector.
match (effective permission)
{
"action": "iam:PassRole",
"resource_type": "AWS::IAM::Role"
}
where
PassedToService condition (if present) allows kafkaconnect.amazonaws.com OR condition is absent (unconditioned)
emit
| source type | Identity |
|---|---|
| target type | MachineIdentity |
| source | <principal> |
| target | <IAM role passable to kafkaconnect.amazonaws.com> |
| permissions | iam:PassRole |
| conditions | iam_permission condition_expression role_compatibility |
| state logic | ACTIVE when iam:PassRole is not restricted by iam:PassedToService OR the condition admits kafkaconnect.amazonaws.com. CONDITIONAL(role_compatibility) when the PassedToService condition is present but the service value is unknown/unresolved. BLOCKED if iam:PassedToService explicitly excludes kafkaconnect.amazonaws.com or an SCP denies iam:PassRole at the effective scope. |
Narrative
{principal.name} can pass {role.name} to MSK Connect (iam:PassRole scoped to kafkaconnect.amazonaws.com). Any code running in a connector configured with {role.name} executes as {role.name}.
Raw rule rules/derived/aws/msk.yaml
id: aws-msk-connect-pass-role
emits: CanPassIdentity
description: iam:PassRole to kafkaconnect.amazonaws.com allows the principal to bind any passable role
to an MSK Connect connector.
match_effective_permission:
action: iam:PassRole
resource_type: AWS::IAM::Role
where:
- PassedToService condition (if present) allows kafkaconnect.amazonaws.com OR condition is absent (unconditioned)
emit:
source_type: Identity
target_type: MachineIdentity
source: <principal>
target: <IAM role passable to kafkaconnect.amazonaws.com>
permissions:
- iam:PassRole
conditions:
- iam_permission
- condition_expression
- role_compatibility
state_logic: ACTIVE when iam:PassRole is not restricted by iam:PassedToService OR the condition admits
kafkaconnect.amazonaws.com. CONDITIONAL(role_compatibility) when the PassedToService condition is
present but the service value is unknown/unresolved. BLOCKED if iam:PassedToService explicitly excludes
kafkaconnect.amazonaws.com or an SCP denies iam:PassRole at the effective scope.
derived_from:
- effective iam:PassRole on role scope
false_positive_note: "Honor iam:PassedToService strictly. A role passable only to lambda.amazonaws.com,\
\ ec2.amazonaws.com, or kafka.amazonaws.com does NOT create a pass-to-kafkaconnect path. The role\
\ must also trust kafkaconnect.amazonaws.com in its trust policy; a role without that principal trust\
\ will fail at connector creation. Downgrade to POTENTIAL(role_compatibility) when the trust is not\
\ confirmed. Also note that MSK replication uses kafka.amazonaws.com, not kafkaconnect.amazonaws.com\
\ \u2014 these are distinct service principals. CanPassIdentity here is the identity-pass capability\
\ only; the CreateConnector gate is in aws-msk-connect-create-workload-as (B5)."
narrative: '{principal.name} can pass {role.name} to MSK Connect (iam:PassRole scoped to kafkaconnect.amazonaws.com).
Any code running in a connector configured with {role.name} executes as {role.name}.'