rage.fail

aws-pass-role

derived aws emits CanPassIdentity

match (effective permission)

{ "action": "iam:PassRole", "resource_type": "AWS::IAM::Role" }

emit

source type	`Identity`
source	`<principal>`
target	`<IAM role passable in scope>`
permissions	`iam:PassRole`
conditions	`role_compatibility`

Narrative

{principal.name} can pass {role.name} to a service (iam:PassRole).

Raw rule rules/derived/aws/identity-escalation.yaml

id: aws-pass-role
emits: CanPassIdentity
match_effective_permission:
  action: iam:PassRole
  resource_type: AWS::IAM::Role
emit:
  source_type: Identity
  source: <principal>
  target: <IAM role passable in scope>
  permissions:
  - iam:PassRole
  conditions:
  - role_compatibility
  note: 'PassRole ALONE is not execution. It becomes CanExecuteAs only when paired with a create/deploy/modify
    capability on a service that (a) accepts the role and (b) the attacker can run. See rule aws-execute-as-via-passrole.

    '
  false_positive_note: "iam:PassRole is frequently scoped by the iam:PassedToService condition; honor\
    \ it \u2014 a role passable only to ec2 does not yield lambda execution."
  narrative: '{principal.name} can pass {role.name} to a service (iam:PassRole).'