aws-opsworks-executes-as-instance-profile
OpsWorks-managed EC2 instance runs as its IAM instance profile role.
match (record)
{
"api": "opsworks:DescribeInstances + ec2:DescribeInstances",
"condition": "IamInstanceProfile.Arn != null AND Status in [online, setup, configure]",
"field": "IamInstanceProfile.Arn",
"join_key": "Ec2InstanceId == InstanceId",
"resource_type": "AWS::OpsWorks::Instance"
}
emit
| source type | VirtualMachine |
|---|---|
| target type | MachineIdentity |
| source | <OpsWorks EC2 instance node (VirtualMachine)> |
| target | <IAM instance profile role (MachineIdentity / Role)> |
| state logic | ACTIVE when the instance is in ONLINE/running state. CONDITIONAL(service_state) when the instance is starting (setup/configure lifecycle state). Do not emit for stopped or terminated instances. |
Narrative
{instance.name} (EC2 instance {ec2_id}) runs as the IAM instance profile role {role.name}; all Chef recipe code and deployment commands execute with this identity's credentials (readable from IMDS).
Raw rule rules/explicit/aws-opsworks.yaml
id: aws-opsworks-executes-as-instance-profile
emits: ExecutesAs
description: OpsWorks-managed EC2 instance runs as its IAM instance profile role.
match_effective_permission: {}
match_record:
resource_type: AWS::OpsWorks::Instance
api: opsworks:DescribeInstances + ec2:DescribeInstances
join_key: Ec2InstanceId == InstanceId
field: IamInstanceProfile.Arn
condition: IamInstanceProfile.Arn != null AND Status in [online, setup, configure]
emit:
source_type: VirtualMachine
target_type: MachineIdentity
source: <OpsWorks EC2 instance node (VirtualMachine)>
target: <IAM instance profile role (MachineIdentity / Role)>
permissions: []
state_logic: ACTIVE when the instance is in ONLINE/running state. CONDITIONAL(service_state) when the
instance is starting (setup/configure lifecycle state). Do not emit for stopped or terminated instances.
confidence: 1.0
evidence_field: ec2:DescribeInstances[].Instances[].IamInstanceProfile.Arn
narrative: '{instance.name} (EC2 instance {ec2_id}) runs as the IAM instance profile role {role.name};
all Chef recipe code and deployment commands execute with this identity''s credentials (readable from
IMDS).'