aws-redshift-create-workload-as
Create a new Redshift cluster (or Serverless namespace) with an attacker-chosen IAM role attached, then run queries as that role.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?principal has EFFECTIVE redshift:CreateCluster (provisioned) OR redshift-serverless:CreateNamespace (serverless)
?role trust policy allows redshift.amazonaws.com
iam:PassRole for ?role permits iam:PassedToService including redshift.amazonaws.com (or unconditioned)
emit
| source type | Identity |
|---|---|
| target type | MachineIdentity |
| source | ?principal |
| target | ?role |
| permissions | iam:PassRole redshift:CreateCluster redshift-data:ExecuteStatement |
| conditions | iam_permission role_compatibility |
| state logic | ACTIVE when iam:PassRole is effective for ?role with iam:PassedToService admitting redshift.amazonaws.com AND the principal has redshift:CreateCluster or redshift-serverless:CreateNamespace. CONDITIONAL(role_compatibility) when the role trust policy or iam:PassedToService admission is unresolved. BLOCKED when an SCP or permission boundary denies iam:PassRole or redshift:CreateCluster. State inherits the weakest CanPassIdentity contributor. |
Narrative
{principal.name} can create a new Redshift cluster with {role.name} attached (iam:PassRole + redshift:CreateCluster), then immediately run queries that use {role.name}'s AWS permissions - no existing cluster access required.
Raw rule rules/derived/aws/redshift.yaml
id: aws-redshift-create-workload-as
emits: CanCreateWorkloadAs
description: Create a new Redshift cluster (or Serverless namespace) with an attacker-chosen IAM role
attached, then run queries as that role.
match:
- - principal: null
- CanPassIdentity
- role: null
where:
- ?principal has EFFECTIVE redshift:CreateCluster (provisioned) OR redshift-serverless:CreateNamespace
(serverless)
- ?role trust policy allows redshift.amazonaws.com
- iam:PassRole for ?role permits iam:PassedToService including redshift.amazonaws.com (or unconditioned)
emit:
source_type: Identity
target_type: MachineIdentity
source: ?principal
target: ?role
permissions:
- iam:PassRole
- redshift:CreateCluster
- redshift-data:ExecuteStatement
conditions:
- iam_permission
- role_compatibility
state_logic: ACTIVE when iam:PassRole is effective for ?role with iam:PassedToService admitting redshift.amazonaws.com
AND the principal has redshift:CreateCluster or redshift-serverless:CreateNamespace. CONDITIONAL(role_compatibility)
when the role trust policy or iam:PassedToService admission is unresolved. BLOCKED when an SCP or
permission boundary denies iam:PassRole or redshift:CreateCluster. State inherits the weakest CanPassIdentity
contributor.
confidence: min(contributing_confidences) * 0.90
derived_from:
- ?principal CanPassIdentity ?role
- "can-execute-as:execute-as-via-new-workload (roll-up \u2014 cited not re-derived)"
false_positive_note: "The cluster must ACTUALLY start before queries can run. Cluster provisioning takes\
\ 5-10 minutes and may be blocked by quota limits or VPC constraints. Emit ACTIVE for the capability\
\ (the attacker CAN create the cluster); note the provisioning delay as a practical consideration\
\ but not an edge state change since no blocking control prevents it. Honor iam:PassedToService as\
\ for rule 1. A VPC subnet-group requirement (redshift:CreateClusterSubnetGroup) may be an additional\
\ gate \u2014 downgrade to CONDITIONAL(iam_permission) when VPC subnet configuration is not established."
narrative: "{principal.name} can create a new Redshift cluster with {role.name} attached (iam:PassRole\
\ + redshift:CreateCluster), then immediately run queries that use {role.name}'s AWS permissions \u2014\
\ no existing cluster access required."