aws-sagemaker-pass-role-create-training-job
iam:PassRole to sagemaker.amazonaws.com for training/processing/hyperparameter-tuning/compilation job creation.
match (effective permission)
{
"action": "iam:PassRole",
"resource_type": "AWS::IAM::Role"
}
where
principal has one or more of: sagemaker:CreateTrainingJob, sagemaker:CreateProcessingJob, sagemaker:CreateHyperParameterTuningJob, sagemaker:CreateCompilationJob
iam:PassedToService condition (if present) includes sagemaker.amazonaws.com
target role trust policy allows sagemaker.amazonaws.com
emit
| source type | Identity |
|---|---|
| target type | MachineIdentity |
| source | <principal> |
| target | <IAM Role passable to sagemaker.amazonaws.com> |
| permissions | iam:PassRole sagemaker:CreateTrainingJob|sagemaker:CreateProcessingJob|sagemaker:CreateHyperParameterTuningJob|sagemaker:CreateCompilationJob |
| conditions | iam_permission condition_expression role_compatibility |
Narrative
{principal.name} can pass {role.name} to a new SageMaker training/processing/ hyper-parameter-tuning/compilation job (iam:PassRole + Create*Job), running a custom container as that role - the classic SageMaker PassRole privilege escalation.
Raw rule rules/explicit/aws/sagemaker.yaml
id: aws-sagemaker-pass-role-create-training-job
emits: CanPassIdentity
description: iam:PassRole to sagemaker.amazonaws.com for training/processing/hyperparameter-tuning/compilation
job creation.
match_effective_permission:
action: iam:PassRole
resource_type: AWS::IAM::Role
where:
- 'principal has one or more of: sagemaker:CreateTrainingJob, sagemaker:CreateProcessingJob, sagemaker:CreateHyperParameterTuningJob,
sagemaker:CreateCompilationJob'
- iam:PassedToService condition (if present) includes sagemaker.amazonaws.com
- target role trust policy allows sagemaker.amazonaws.com
emit:
source_type: Identity
target_type: MachineIdentity
source: <principal>
target: <IAM Role passable to sagemaker.amazonaws.com>
permissions:
- iam:PassRole
- sagemaker:CreateTrainingJob|sagemaker:CreateProcessingJob|sagemaker:CreateHyperParameterTuningJob|sagemaker:CreateCompilationJob
conditions:
- iam_permission
- condition_expression
- role_compatibility
false_positive_note: "Honor iam:PassedToService. The training job must actually be submitted to run\
\ the code; this edge is CanPassIdentity (pre-condition for CanCreateWorkloadAs). The escalation roll-up\
\ (CanCreateWorkloadAs -> CanExecuteAs) is performed by can-execute-as.yaml (execute-as-via-new-workload)\
\ \u2014 cite, do not re-derive. Processing/HPO/compilation jobs follow identical PassRole semantics;\
\ emit with all applicable create actions in the permissions list to reflect the full set of workload-creation\
\ capabilities the principal possesses."
narrative: "{principal.name} can pass {role.name} to a new SageMaker training/processing/ hyper-parameter-tuning/compilation\
\ job (iam:PassRole + Create*Job), running a custom container as that role \u2014 the classic SageMaker\
\ PassRole privilege escalation."