aws-opsworks-clone-stack-pass-role
opsworks:CloneStack + iam:PassRole on a privileged role lets a principal create a cloned stack running as that role.
match (effective permission)
{
"actions": [
"opsworks:CloneStack",
"iam:PassRole"
],
"resource_type": "AWS::OpsWorks::Stack"
}
where
principal has effective iam:PassRole on a role trusted by ec2.amazonaws.com or opsworks.amazonaws.com
emit
| source type | Identity |
|---|---|
| target type | Role |
| source | <principal> |
| target | <Role passable to ec2.amazonaws.com or opsworks.amazonaws.com> |
| permissions | opsworks:CloneStack iam:PassRole |
| conditions | role_compatibility iam_permission |
| state logic | ACTIVE when the principal has both opsworks:CloneStack (account-level) and iam:PassRole on a role trusted by ec2.amazonaws.com (instance profile) or opsworks.amazonaws.com (service role). POTENTIAL(role_compatibility) when the role trust policy is unknown. |
Narrative
{principal.name} can call opsworks:CloneStack to create a copy of an OpsWorks stack and bind a chosen role to it (opsworks:CloneStack + iam:PassRole), making the cloned stack's instances run as that role.
Raw rule rules/explicit/aws-opsworks.yaml
id: aws-opsworks-clone-stack-pass-role
emits: CanPassIdentity
description: opsworks:CloneStack + iam:PassRole on a privileged role lets a principal create a cloned
stack running as that role.
match_effective_permission:
actions:
- opsworks:CloneStack
- iam:PassRole
resource_type: AWS::OpsWorks::Stack
where:
- principal has effective iam:PassRole on a role trusted by ec2.amazonaws.com or opsworks.amazonaws.com
emit:
source_type: Identity
target_type: Role
source: <principal>
target: <Role passable to ec2.amazonaws.com or opsworks.amazonaws.com>
permissions:
- opsworks:CloneStack
- iam:PassRole
conditions:
- role_compatibility
- iam_permission
state_logic: ACTIVE when the principal has both opsworks:CloneStack (account-level) and iam:PassRole
on a role trusted by ec2.amazonaws.com (instance profile) or opsworks.amazonaws.com (service role).
POTENTIAL(role_compatibility) when the role trust policy is unknown.
confidence: 0.85
narrative: '{principal.name} can call opsworks:CloneStack to create a copy of an OpsWorks stack and
bind a chosen role to it (opsworks:CloneStack + iam:PassRole), making the cloned stack''s instances
run as that role.'