aws-quicksight-pass-service-role
quicksight:UpdateAccountSettings + iam:PassRole (to quicksight.amazonaws.com) lets an attacker swap the QuickSight service role.
match (effective permission)
{
"action": [
"quicksight:UpdateAccountSettings",
"iam:PassRole"
],
"resource_type": [
"AWS::QuickSight::AccountSettings",
"AWS::IAM::Role"
]
}
where
principal has EFFECTIVE quicksight:UpdateAccountSettings on the QuickSight account settings
principal has EFFECTIVE iam:PassRole on the target IAM role
iam:PassedToService condition (if present) includes quicksight.amazonaws.com or is absent (unconditioned)
the QuickSight account subscription is ACTIVE
emit
| source type | Identity |
|---|---|
| target type | Role |
| source | <principal with quicksight:UpdateAccountSettings + iam:PassRole> |
| target | <IAM role passable to quicksight.amazonaws.com> |
| permissions | quicksight:UpdateAccountSettings iam:PassRole |
| conditions | iam_permission condition_expression role_compatibility |
| state logic | ACTIVE when principal has both quicksight:UpdateAccountSettings and iam:PassRole on the target role with PassedToService allowing quicksight.amazonaws.com (or unconditioned). CONDITIONAL(role_compatibility) when the PassedToService condition is unknown/unresolved or permits only non-QuickSight services. BLOCKED if an SCP or permission boundary denies either action. |
Narrative
{principal.name} can update QuickSight account settings (quicksight:UpdateAccountSettings) and pass {role.name} to quicksight.amazonaws.com (iam:PassRole), swapping the QuickSight service role so all subsequent data queries run as {role.name}.
Raw rule rules/explicit/aws/quicksight.yaml
id: aws-quicksight-pass-service-role
emits: CanPassIdentity
description: quicksight:UpdateAccountSettings + iam:PassRole (to quicksight.amazonaws.com) lets an attacker
swap the QuickSight service role.
match_effective_permission:
action:
- quicksight:UpdateAccountSettings
- iam:PassRole
resource_type:
- AWS::QuickSight::AccountSettings
- AWS::IAM::Role
where:
- principal has EFFECTIVE quicksight:UpdateAccountSettings on the QuickSight account settings
- principal has EFFECTIVE iam:PassRole on the target IAM role
- iam:PassedToService condition (if present) includes quicksight.amazonaws.com or is absent (unconditioned)
- the QuickSight account subscription is ACTIVE
emit:
source_type: Identity
target_type: Role
source: <principal with quicksight:UpdateAccountSettings + iam:PassRole>
target: <IAM role passable to quicksight.amazonaws.com>
permissions:
- quicksight:UpdateAccountSettings
- iam:PassRole
conditions:
- iam_permission
- condition_expression
- role_compatibility
state_logic: ACTIVE when principal has both quicksight:UpdateAccountSettings and iam:PassRole on the
target role with PassedToService allowing quicksight.amazonaws.com (or unconditioned). CONDITIONAL(role_compatibility)
when the PassedToService condition is unknown/unresolved or permits only non-QuickSight services.
BLOCKED if an SCP or permission boundary denies either action.
confidence: min(contributing_confidences) * 0.95
derived_from: []
false_positive_note: 'iam:PassRole is the hard gate: quicksight:UpdateAccountSettings alone cannot change
the service role without a matching PassRole grant scoped to quicksight.amazonaws.com. Honor iam:PassedToService:
a role passable only to ec2.amazonaws.com does NOT become a QuickSight service role. Do not emit if
the QuickSight subscription is not ACTIVE (no subscription -> UpdateAccountSettings has no effect).
The escalation consequence (CanExecuteAs the new role) is produced by a QuickSight-specific derived
rule that handles the GenericData node class limitation.'
narrative: '{principal.name} can update QuickSight account settings (quicksight:UpdateAccountSettings)
and pass {role.name} to quicksight.amazonaws.com (iam:PassRole), swapping the QuickSight service role
so all subsequent data queries run as {role.name}.'