aws-sagemaker-pass-role-create-pipeline
iam:PassRole to sagemaker.amazonaws.com for pipeline creation, giving attacker-controlled pipeline steps the passed role's credentials.
match (effective permission)
{
"action": "iam:PassRole",
"resource_type": "AWS::IAM::Role"
}
where
principal has sagemaker:CreatePipeline
iam:PassedToService condition (if present) includes sagemaker.amazonaws.com
target role trust policy allows sagemaker.amazonaws.com
emit
| source type | Identity |
|---|---|
| target type | MachineIdentity |
| source | <principal> |
| target | <IAM Role passable to sagemaker.amazonaws.com> |
| permissions | iam:PassRole sagemaker:CreatePipeline |
| conditions | iam_permission condition_expression role_compatibility |
Narrative
{principal.name} can create a SageMaker pipeline passing {role.name} as its execution role (iam:PassRole + sagemaker:CreatePipeline), then start it to run attacker-controlled steps as {role.name}.
Raw rule rules/explicit/aws/sagemaker.yaml
id: aws-sagemaker-pass-role-create-pipeline
emits: CanPassIdentity
description: iam:PassRole to sagemaker.amazonaws.com for pipeline creation, giving attacker-controlled
pipeline steps the passed role's credentials.
match_effective_permission:
action: iam:PassRole
resource_type: AWS::IAM::Role
where:
- principal has sagemaker:CreatePipeline
- iam:PassedToService condition (if present) includes sagemaker.amazonaws.com
- target role trust policy allows sagemaker.amazonaws.com
emit:
source_type: Identity
target_type: MachineIdentity
source: <principal>
target: <IAM Role passable to sagemaker.amazonaws.com>
permissions:
- iam:PassRole
- sagemaker:CreatePipeline
conditions:
- iam_permission
- condition_expression
- role_compatibility
false_positive_note: PassRole to create pipeline combined with sagemaker:StartPipelineExecution is required
to fully execute; CanPassIdentity alone is the capability to attach. The can-execute-as linchpin produces
the CanCreateWorkloadAs/ CanExecuteAs roll-up.
narrative: '{principal.name} can create a SageMaker pipeline passing {role.name} as its execution role
(iam:PassRole + sagemaker:CreatePipeline), then start it to run attacker-controlled steps as {role.name}.'