rage.fail

aws-redshift-can-modify-cluster-iam-roles

explicit aws emits CanModifyConfiguration

match (effective permission)

{ "action": "redshift:ModifyClusterIamRoles", "resource_type": "AWS::Redshift::Cluster" }

emit

source type	`Identity`
target type	`Data`
source	`<principal>`
target	`<cluster node>`
permissions	`redshift:ModifyClusterIamRoles`

Narrative

{principal.name} can attach or detach IAM roles on {cluster.name} (redshift:ModifyClusterIamRoles). This capability is a prerequisite for CanPassIdentity + CanModifyConfiguration → CanExecuteAs privesc paths.

Raw rule rules/explicit/aws-redshift.yaml

id: aws-redshift-can-modify-cluster-iam-roles
emits: CanModifyConfiguration
match_effective_permission:
  action: redshift:ModifyClusterIamRoles
  resource_type: AWS::Redshift::Cluster
emit:
  source_type: Identity
  target_type: Data
  source: <principal>
  target: <cluster node>
  permissions:
  - redshift:ModifyClusterIamRoles
  api_source: iam:GetRole (effective policy evaluation)
  narrative: "{principal.name} can attach or detach IAM roles on {cluster.name} (redshift:ModifyClusterIamRoles).\
    \ This capability is a prerequisite for CanPassIdentity + CanModifyConfiguration \u2192 CanExecuteAs\
    \ privesc paths."