aws-s3-batch-create-workload-as
s3:CreateJob + iam:PassRole for a privileged IAM role creates an S3 Batch Operations job that runs as that role - a CanCreateWorkloadAs pattern for S3 Batch.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?principal has EFFECTIVE s3:CreateJob (resource scope)
?role trust policy allows batchoperations.s3.amazonaws.com as service principal
iam:PassRole for ?role permits iam:PassedToService including batchoperations.s3.amazonaws.com (or unconditioned)
emit
| source type | Identity |
|---|---|
| target type | MachineIdentity |
| source | ?principal |
| target | ?role |
| permissions | iam:PassRole s3:CreateJob |
| conditions | iam_permission role_compatibility |
| state logic | ACTIVE when iam:PassRole is effective for ?role with iam:PassedToService admitting batchoperations.s3.amazonaws.com AND the principal has s3control:CreateJob. CONDITIONAL(role_compatibility) when the role trust policy or iam:PassedToService admission for batchoperations.s3.amazonaws.com is unresolved. BLOCKED when an SCP or permission boundary denies iam:PassRole or s3control:CreateJob. Cite can-execute-as:execute-as-via-new-workload for the escalation roll-up when the role's privilege exceeds the caller's. |
Narrative
{principal.name} can pass {role.name} to S3 Batch Operations (s3:CreateJob + iam:PassRole) and create a batch job that runs as {role.name}, operating on any S3 objects that role can access.
Raw rule rules/derived/aws/s3.yaml
id: aws-s3-batch-create-workload-as
emits: CanCreateWorkloadAs
description: "s3:CreateJob + iam:PassRole for a privileged IAM role creates an S3 Batch Operations job\
\ that runs as that role \u2014 a CanCreateWorkloadAs pattern for S3 Batch."
match:
- - principal: null
- CanPassIdentity
- role: null
where:
- ?principal has EFFECTIVE s3:CreateJob (resource scope)
- ?role trust policy allows batchoperations.s3.amazonaws.com as service principal
- iam:PassRole for ?role permits iam:PassedToService including batchoperations.s3.amazonaws.com (or unconditioned)
emit:
source_type: Identity
target_type: MachineIdentity
source: ?principal
target: ?role
permissions:
- iam:PassRole
- s3:CreateJob
conditions:
- iam_permission
- role_compatibility
state_logic: ACTIVE when iam:PassRole is effective for ?role with iam:PassedToService admitting batchoperations.s3.amazonaws.com
AND the principal has s3control:CreateJob. CONDITIONAL(role_compatibility) when the role trust policy
or iam:PassedToService admission for batchoperations.s3.amazonaws.com is unresolved. BLOCKED when
an SCP or permission boundary denies iam:PassRole or s3control:CreateJob. Cite can-execute-as:execute-as-via-new-workload
for the escalation roll-up when the role's privilege exceeds the caller's.
confidence: min(contributing_confidences) * 0.90
derived_from:
- ?principal CanPassIdentity ?role
- "can-execute-as:execute-as-via-new-workload (roll-up \u2014 cited not re-derived)"
false_positive_note: "The role trust policy must name batchoperations.s3.amazonaws.com (not s3.amazonaws.com);\
\ these are distinct service principals. If iam:PassedToService is conditioned to another service\
\ (e.g. lambda.amazonaws.com only), this path does NOT apply \u2014 downgrade to POTENTIAL(role_compatibility).\
\ The Batch Operations job has a scope (the manifest/report output bucket and the operation type \u2014\
\ PutObject, CopyObject, DeleteObject, InvokeFunction, etc.); the attacker-chosen operation determines\
\ the impact. CreateJob requires a manifest (list of objects to operate on) and a report destination\
\ bucket \u2014 both are attacker-controlled when the attacker creates the job. Batch operations against\
\ a compliance-locked bucket (Object Lock) will fail for locked objects."
narrative: '{principal.name} can pass {role.name} to S3 Batch Operations (s3:CreateJob + iam:PassRole)
and create a batch job that runs as {role.name}, operating on any S3 objects that role can access.'