rage.fail

aws-redshift-serverless-update-namespace-config

explicit aws emits CanModifyConfiguration

match (effective permission)

{ "action": "redshift-serverless:UpdateNamespace", "resource_type": "AWS::RedshiftServerless::Namespace" }

emit

source type	`Identity`
target type	`Data`
source	`<principal>`
target	`<namespace node>`
permissions	`redshift-serverless:UpdateNamespace`

Narrative

{principal.name} can update the Serverless namespace {namespace.name}, including its IAM roles (redshift-serverless:UpdateNamespace). This capability is the Serverless equivalent of redshift:ModifyClusterIamRoles and is a prerequisite for PassRole privesc paths on Serverless.

Raw rule rules/explicit/aws-redshift.yaml

id: aws-redshift-serverless-update-namespace-config
emits: CanModifyConfiguration
match_effective_permission:
  action: redshift-serverless:UpdateNamespace
  resource_type: AWS::RedshiftServerless::Namespace
emit:
  source_type: Identity
  target_type: Data
  source: <principal>
  target: <namespace node>
  permissions:
  - redshift-serverless:UpdateNamespace
  api_source: iam:GetRole (effective policy evaluation)
  narrative: '{principal.name} can update the Serverless namespace {namespace.name}, including its IAM
    roles (redshift-serverless:UpdateNamespace). This capability is the Serverless equivalent of redshift:ModifyClusterIamRoles
    and is a prerequisite for PassRole privesc paths on Serverless.'