aws-opsworks-can-modify-trust-update-stack-service-role
opsworks:UpdateStack + iam:PassRole on the new service role swaps the identity OpsWorks operates as.
match (effective permission)
{
"action": "opsworks:UpdateStack",
"resource_type": "AWS::OpsWorks::Stack"
}
where
principal also has effective iam:PassRole on a role trusted by opsworks.amazonaws.com
emit
| source type | Identity |
|---|---|
| target type | Role |
| source | <principal> |
| target | <OpsWorks service role passable to opsworks.amazonaws.com> |
| permissions | opsworks:UpdateStack iam:PassRole |
Narrative
{principal.name} can change {stack.name}'s service role (opsworks:UpdateStack + iam:PassRole) to a chosen IAM role trusted by opsworks.amazonaws.com, redirecting OpsWorks control-plane operations to that identity.
Raw rule rules/explicit/aws-opsworks.yaml
id: aws-opsworks-can-modify-trust-update-stack-service-role
emits: CanModifyTrust
description: opsworks:UpdateStack + iam:PassRole on the new service role swaps the identity OpsWorks operates
as.
match_effective_permission:
action: opsworks:UpdateStack
resource_type: AWS::OpsWorks::Stack
where:
- principal also has effective iam:PassRole on a role trusted by opsworks.amazonaws.com
emit:
source_type: Identity
target_type: Role
source: <principal>
target: <OpsWorks service role passable to opsworks.amazonaws.com>
permissions:
- opsworks:UpdateStack
- iam:PassRole
narrative: '{principal.name} can change {stack.name}''s service role (opsworks:UpdateStack + iam:PassRole)
to a chosen IAM role trusted by opsworks.amazonaws.com, redirecting OpsWorks control-plane operations
to that identity.'