aws-quicksight-config-identity-swap

An attacker who can modify QuickSight's configuration (UpdateAccountSettings) and pass an IAM role to it gains execution as that role for all data queries.

derived aws emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Identity`
source	`?attacker`
target	`?role`
permissions	`quicksight:UpdateAccountSettings` `iam:PassRole`
conditions	`iam_permission` `role_compatibility`
state logic	ACTIVE when both CanModifyConfiguration(attacker, QuickSight) and CanPassIdentity(attacker, role) edges are ACTIVE and the role is compatible. CONDITIONAL otherwise.

source type

Identity

target type

Identity

source

?attacker

target

?role

permissions

quicksight:UpdateAccountSettings iam:PassRole

conditions

iam_permission role_compatibility

state logic

ACTIVE when both CanModifyConfiguration(attacker, QuickSight) and CanPassIdentity(attacker, role) edges are ACTIVE and the role is compatible. CONDITIONAL otherwise.

Narrative

{attacker.name} can modify QuickSight's account settings (quicksight:UpdateAccountSettings) and pass {role.name} to it, causing {attacker.name} to execute as {role.name} for all subsequent QuickSight data queries.

Raw rule rules/derived/aws/quicksight.yaml

id: aws-quicksight-config-identity-swap
emits: CanExecuteAs
description: An attacker who can modify QuickSight's configuration (UpdateAccountSettings) and pass an
  IAM role to it gains execution as that role for all data queries.
applies_to:
- aws
match:
- - attacker: null
  - CanModifyConfiguration
  - quicksight: null
- - attacker: null
  - CanPassIdentity
  - role: null
where:
- node_type(?quicksight) == GenericData
- ?quicksight.provider_type == 'AWS::QuickSight::AccountSettings' or 'AWS::QuickSight::Account'
- role_compatible(?role, ?quicksight)
emit:
  source_type: Identity
  target_type: Identity
  source: ?attacker
  target: ?role
  permissions:
  - quicksight:UpdateAccountSettings
  - iam:PassRole
  conditions:
  - iam_permission
  - role_compatibility
  state_logic: ACTIVE when both CanModifyConfiguration(attacker, QuickSight) and CanPassIdentity(attacker,
    role) edges are ACTIVE and the role is compatible. CONDITIONAL otherwise.
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - aws-quicksight-pass-service-role (explicit)
  - CanModifyConfiguration edges
  false_positive_note: This composition assumes the QuickSight account settings resource maps to a GenericData
    node (the service node). Standard path queries should prefer the linchpin rule execute-as-via-config-identity-swap
    for Compute nodes; this rule specializes to QuickSight's architecture.
  narrative: '{attacker.name} can modify QuickSight''s account settings (quicksight:UpdateAccountSettings)
    and pass {role.name} to it, causing {attacker.name} to execute as {role.name} for all subsequent QuickSight
    data queries.'