aws-opsworks-pass-role-to-stack
iam:PassRole for opsworks.amazonaws.com (service role) or ec2.amazonaws.com (instance profile) plus opsworks:CreateStack or opsworks:UpdateStack lets a principal bind a chosen role to a stack.
match (effective permission)
{
"actions": [
"iam:PassRole",
"opsworks:CreateStack"
],
"resource_type": "AWS::OpsWorks::Stack"
}
where
iam:PassRole scoped to a role trusted by opsworks.amazonaws.com or ec2.amazonaws.com
emit
| source type | Identity |
|---|---|
| target type | Role |
| source | <principal> |
| target | <Role trusted by opsworks.amazonaws.com or ec2.amazonaws.com> |
| permissions | iam:PassRole opsworks:CreateStack |
| conditions | role_compatibility iam_permission |
| state logic | ACTIVE when role trust allows opsworks.amazonaws.com (service role) or ec2.amazonaws.com (instance profile) AND the principal has the stack-level write action (opsworks:CreateStack or opsworks:UpdateStack). POTENTIAL(role_compatibility) when the trust policy is unknown or does not clearly admit the OpsWorks/EC2 principal. The downstream CanExecuteAs (via CanModifyCode + ExecutesAs after binding) is derived by cicd-chains rule 1; this edge is a primitive fact for path-finding. |
Narrative
{principal.name} can pass {role.name} to OpsWorks (iam:PassRole) and create or update a stack (opsworks:CreateStack / opsworks:UpdateStack) to bind {role.name} as the instance profile; subsequent deployments execute code as {role.name}.
Raw rule rules/explicit/aws-opsworks.yaml
id: aws-opsworks-pass-role-to-stack
emits: CanPassIdentity
description: iam:PassRole for opsworks.amazonaws.com (service role) or ec2.amazonaws.com (instance profile)
plus opsworks:CreateStack or opsworks:UpdateStack lets a principal bind a chosen role to a stack.
match_effective_permission:
actions:
- iam:PassRole
- opsworks:CreateStack
resource_type: AWS::OpsWorks::Stack
where:
- iam:PassRole scoped to a role trusted by opsworks.amazonaws.com or ec2.amazonaws.com
emit:
source_type: Identity
target_type: Role
source: <principal>
target: <Role trusted by opsworks.amazonaws.com or ec2.amazonaws.com>
permissions:
- iam:PassRole
- opsworks:CreateStack
conditions:
- role_compatibility
- iam_permission
state_logic: ACTIVE when role trust allows opsworks.amazonaws.com (service role) or ec2.amazonaws.com
(instance profile) AND the principal has the stack-level write action (opsworks:CreateStack or opsworks:UpdateStack).
POTENTIAL(role_compatibility) when the trust policy is unknown or does not clearly admit the OpsWorks/EC2
principal. The downstream CanExecuteAs (via CanModifyCode + ExecutesAs after binding) is derived by
cicd-chains rule 1; this edge is a primitive fact for path-finding.
confidence: 0.9
narrative: '{principal.name} can pass {role.name} to OpsWorks (iam:PassRole) and create or update a
stack (opsworks:CreateStack / opsworks:UpdateStack) to bind {role.name} as the instance profile; subsequent
deployments execute code as {role.name}.'