aws-rolesanywhere-config-add-profile

Creating/updating a Roles Anywhere profile that lists a privileged role (with iam:PassRole) maps the attacker's cert to that role.

derived aws emits CanModifyTrust

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanPassIdentity {'role': None}

where

node_type(?role) == Role ?principal has EFFECTIVE rolesanywhere:CreateProfile OR rolesanywhere:UpdateProfile (+ EnableProfile? if disabled) iam:PassRole for ?role permits it (Roles Anywhere assumes/passes the profile roles; honor any iam:PassedToService condition) ?role trust policy trusts rolesanywhere.amazonaws.com and its cert-attribute/aws:SourceArn condition is satisfiable by a cert the attacker can present (via an existing or attacker-added trust anchor — rule 2)

emit

source type	`Identity`
target type	`Role`
source	`?principal`
target	`?role`
permissions	`rolesanywhere:CreateProfile` `rolesanywhere:UpdateProfile` `iam:PassRole`
conditions	`trust_condition` `iam_permission` `role_compatibility`
state logic	ACTIVE when the principal can pass ?role (iam:PassRole admits it) AND can create/update a profile listing ?role AND ?role's trust admits a cert the attacker can present (existing anchor with a broad/unpinned trust, or an attacker-added anchor from rule 2). CONDITIONAL(trust_condition) when the role trust pins a cert subject/anchor the attacker cannot satisfy. POTENTIAL/BLOCKED when iam:PassRole is missing/denied for ?role (no profile mapping possible) or an SCP denies rolesanywhere:CreateProfile/UpdateProfile — honor iam:PassRole strictly.

Narrative

{principal.name} can create or update a Roles Anywhere profile that lists {role.name} (rolesanywhere:CreateProfile/UpdateProfile + iam:PassRole), mapping a certificate it can present to {role.name} - self-granting federation into {role.name}.

Raw rule rules/derived/aws/rolesanywhere.yaml

id: aws-rolesanywhere-config-add-profile
emits: CanModifyTrust
description: Creating/updating a Roles Anywhere profile that lists a privileged role (with iam:PassRole)
  maps the attacker's cert to that role.
match:
- - principal: null
  - CanPassIdentity
  - role: null
where:
- node_type(?role) == Role
- ?principal has EFFECTIVE rolesanywhere:CreateProfile OR rolesanywhere:UpdateProfile (+ EnableProfile?
  if disabled)
- iam:PassRole for ?role permits it (Roles Anywhere assumes/passes the profile roles; honor any iam:PassedToService
  condition)
- "?role trust policy trusts rolesanywhere.amazonaws.com and its cert-attribute/aws:SourceArn condition\
  \ is satisfiable by a cert the attacker can present (via an existing or attacker-added trust anchor\
  \ \u2014 rule 2)"
emit:
  source_type: Identity
  target_type: Role
  source: ?principal
  target: ?role
  permissions:
  - rolesanywhere:CreateProfile
  - rolesanywhere:UpdateProfile
  - iam:PassRole
  conditions:
  - trust_condition
  - iam_permission
  - role_compatibility
  state_logic: "ACTIVE when the principal can pass ?role (iam:PassRole admits it) AND can create/update\
    \ a profile listing ?role AND ?role's trust admits a cert the attacker can present (existing anchor\
    \ with a broad/unpinned trust, or an attacker-added anchor from rule 2). CONDITIONAL(trust_condition)\
    \ when the role trust pins a cert subject/anchor the attacker cannot satisfy. POTENTIAL/BLOCKED when\
    \ iam:PassRole is missing/denied for ?role (no profile mapping possible) or an SCP denies rolesanywhere:CreateProfile/UpdateProfile\
    \ \u2014 honor iam:PassRole strictly."
  confidence: min(contributing_confidences) * 0.9
  derived_from:
  - ?principal CanPassIdentity ?role
  - <effective rolesanywhere:CreateProfile|UpdateProfile decision>
  false_positive_note: "REQUIRES iam:PassRole for ?role \u2014 a profile cannot list a role the caller\
    \ cannot pass. Honor any iam:PassedToService condition on the PassRole grant; if it excludes Roles\
    \ Anywhere the mapping fails => downgrade. The profile only yields federation if ?role's trust ALSO\
    \ admits the attacker's cert \u2014 a profile listing a role whose trust pins a subject/anchor the\
    \ attacker cannot present stays CONDITIONAL(trust_condition). This is the profile-write half of the\
    \ config self-grant; pair with rule 2 when the attacker also needs to add a matching anchor. The session\
    \ policy on the profile only CAPS the resulting session \u2014 it cannot grant more than the role\
    \ already has."
  narrative: "{principal.name} can create or update a Roles Anywhere profile that lists {role.name} (rolesanywhere:CreateProfile/UpdateProfile\
    \ + iam:PassRole), mapping a certificate it can present to {role.name} \u2014 self-granting federation\
    \ into {role.name}."