aws-msk-replication-pass-role
iam:PassRole to kafka.amazonaws.com allows the principal to bind any passable role as the replication execution role of a new MSK Replicator.
match (effective permission)
{
"action": "iam:PassRole",
"resource_type": "AWS::IAM::Role"
}
where
PassedToService condition (if present) allows kafka.amazonaws.com OR condition is absent (unconditioned)
emit
| source type | Identity |
|---|---|
| target type | MachineIdentity |
| source | <principal> |
| target | <IAM role passable to kafka.amazonaws.com for replication> |
| permissions | iam:PassRole |
| conditions | iam_permission condition_expression role_compatibility |
| state logic | ACTIVE when iam:PassRole is not restricted by iam:PassedToService OR the condition admits kafka.amazonaws.com. CONDITIONAL(role_compatibility) when the PassedToService condition is present but the service value is unknown/unresolved. BLOCKED if iam:PassedToService explicitly excludes kafka.amazonaws.com or an SCP denies iam:PassRole at the effective scope. |
Narrative
{principal.name} can pass {role.name} to MSK Replication (iam:PassRole scoped to kafka.amazonaws.com). A replicator configured with {role.name} runs as {role.name}, reaching both source and destination clusters with its credentials.
Raw rule rules/derived/aws/msk.yaml
id: aws-msk-replication-pass-role
emits: CanPassIdentity
description: iam:PassRole to kafka.amazonaws.com allows the principal to bind any passable role as the
replication execution role of a new MSK Replicator.
match_effective_permission:
action: iam:PassRole
resource_type: AWS::IAM::Role
where:
- PassedToService condition (if present) allows kafka.amazonaws.com OR condition is absent (unconditioned)
emit:
source_type: Identity
target_type: MachineIdentity
source: <principal>
target: <IAM role passable to kafka.amazonaws.com for replication>
permissions:
- iam:PassRole
conditions:
- iam_permission
- condition_expression
- role_compatibility
state_logic: ACTIVE when iam:PassRole is not restricted by iam:PassedToService OR the condition admits
kafka.amazonaws.com. CONDITIONAL(role_compatibility) when the PassedToService condition is present
but the service value is unknown/unresolved. BLOCKED if iam:PassedToService explicitly excludes kafka.amazonaws.com
or an SCP denies iam:PassRole at the effective scope.
derived_from:
- effective iam:PassRole on role scope
false_positive_note: "Honor iam:PassedToService strictly. A role passable only to kafkaconnect.amazonaws.com,\
\ lambda.amazonaws.com, or ec2.amazonaws.com does NOT create a pass-to-kafka-replication path. The\
\ role must also trust kafka.amazonaws.com in its trust policy; a role without that principal trust\
\ will fail at replicator creation. Downgrade to POTENTIAL(role_compatibility) when the trust is not\
\ confirmed. MSK Replication uses kafka.amazonaws.com; MSK Connect uses kafkaconnect.amazonaws.com\
\ \u2014 these are distinct service principals."
narrative: '{principal.name} can pass {role.name} to MSK Replication (iam:PassRole scoped to kafka.amazonaws.com).
A replicator configured with {role.name} runs as {role.name}, reaching both source and destination
clusters with its credentials.'