aws-msk-replication-create-workload-as
Creating a new MSK Replicator bound to a passable execution role is CanCreateWorkloadAs: replication tasks run as that role.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?principal has EFFECTIVE kafka:CreateReplicator
?role trust policy allows kafka.amazonaws.com (or unknown/unresolved — POTENTIAL)
iam:PassRole for ?role admits kafka.amazonaws.com (or unconditioned)
emit
| source type | Identity |
|---|---|
| target type | MachineIdentity |
| source | ?principal |
| target | ?role |
| permissions | iam:PassRole kafka:CreateReplicator |
| conditions | iam_permission role_compatibility |
| state logic | ACTIVE when ?role trust policy allows kafka.amazonaws.com AND principal has effective kafka:CreateReplicator AND iam:PassRole admits kafka.amazonaws.com. POTENTIAL(role_compatibility) when the role trust is unknown/unresolved — the replicator will fail to start if the role does not trust kafka.amazonaws.com. BLOCKED if PassedToService explicitly excludes kafka.amazonaws.com or SCP denies iam:PassRole or kafka:CreateReplicator. |
Narrative
{principal.name} can create a new MSK Replicator bound to {role.name} (iam:PassRole + kafka:CreateReplicator). Replication tasks running in the replicator execute as {role.name}, reaching both source and destination clusters with that role's permissions.
Raw rule rules/derived/aws/msk.yaml
id: aws-msk-replication-create-workload-as
emits: CanCreateWorkloadAs
description: 'Creating a new MSK Replicator bound to a passable execution role is CanCreateWorkloadAs:
replication tasks run as that role.'
match:
- - principal: null
- CanPassIdentity
- role: null
where:
- ?principal has EFFECTIVE kafka:CreateReplicator
- "?role trust policy allows kafka.amazonaws.com (or unknown/unresolved \u2014 POTENTIAL)"
- iam:PassRole for ?role admits kafka.amazonaws.com (or unconditioned)
emit:
source_type: Identity
target_type: MachineIdentity
source: ?principal
target: ?role
permissions:
- iam:PassRole
- kafka:CreateReplicator
conditions:
- iam_permission
- role_compatibility
state_logic: "ACTIVE when ?role trust policy allows kafka.amazonaws.com AND principal has effective\
\ kafka:CreateReplicator AND iam:PassRole admits kafka.amazonaws.com. POTENTIAL(role_compatibility)\
\ when the role trust is unknown/unresolved \u2014 the replicator will fail to start if the role does\
\ not trust kafka.amazonaws.com. BLOCKED if PassedToService explicitly excludes kafka.amazonaws.com\
\ or SCP denies iam:PassRole or kafka:CreateReplicator."
confidence: min(contributing_confidences) * 0.95
derived_from:
- ?principal CanPassIdentity ?role (aws-msk-replication-pass-role)
- kafka:CreateReplicator check
false_positive_note: "Honor iam:PassedToService and the role trust policy. A role passable only to kafkaconnect.amazonaws.com\
\ or ec2.amazonaws.com cannot be bound to MSK Replication. CanCreateWorkloadAs captures the create+bind\
\ capability; the full CanExecuteAs derivation is handled by can-execute-as.execute-as-via-new-workload\
\ once this edge is present. Requires creating a valid replicator configuration (source & destination\
\ cluster ARNs, topic mappings, etc.) \u2014 not a one-permission escalation, but the iam:PassRole\
\ + CreateReplicator pair is the binding gate. The replicator role reads from the source cluster (kafka-cluster:ReadData\
\ cross-account) and writes to the destination; cross-cluster/cross-account data flow is driven by\
\ the role's inherited permissions (source cluster policy + destination IAM policy)."
narrative: '{principal.name} can create a new MSK Replicator bound to {role.name} (iam:PassRole + kafka:CreateReplicator).
Replication tasks running in the replicator execute as {role.name}, reaching both source and destination
clusters with that role''s permissions.'