aws-sc-service-action-executes-as

servicecatalog:ExecuteProvisionedProductServiceAction on an associated SSM Automation service action executes the automation document as the service action's automation role. A principal who can trigger a provisioned product and execute its service actions runs arbitrary SSM Automation as the automation role.

derived aws emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanTrigger {'provisioned_product': None} {'service_action': None} ExecutesAs {'automation_role': None}

where

node_type(?service_action) == GenericManagement # AWS::ServiceCatalog::ServiceAction (SSM Automation wrapper) ?service_action is associated with ?provisioned_product (or ?provisioned_product's product) ?principal has EFFECTIVE servicecatalog:ExecuteProvisionedProductServiceAction on ?provisioned_product

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

{'principal': None} CanModifyCode {'service_action': None}

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`?automation_role`
permissions	`servicecatalog:ExecuteProvisionedProductServiceAction`
conditions	`iam_permission` `service_state`
state logic	ACTIVE when ?principal has EFFECTIVE servicecatalog:ExecuteProvisionedProductServiceAction on the provisioned product AND can trigger it (CanTrigger), and the service action is associated and configured. CONDITIONAL(service_state) when the service action association exists but the automation role trust or configuration is unverified. BLOCKED when an SCP or permission boundary denies servicecatalog:ExecuteProvisionedProductServiceAction at the effective scope, or when the service action is not associated with the product.

Narrative

{principal.name} can trigger provisioned product {provisioned_product.name} (servicecatalog:ExecuteProvisionedProductServiceAction) and execute its associated service action {service_action.name}. {service_action.name} runs the SSM Automation document as {automation_role.name}, granting {automation_role.name}'s permissions to {principal.name}. This is a separate execution path from the product's launch role.

Raw rule rules/derived/aws/servicecatalog.yaml

id: aws-sc-service-action-executes-as
emits: CanExecuteAs
description: servicecatalog:ExecuteProvisionedProductServiceAction on an associated SSM Automation service
  action executes the automation document as the service action's automation role. A principal who can
  trigger a provisioned product and execute its service actions runs arbitrary SSM Automation as the automation
  role.
match:
- - principal: null
  - CanTrigger
  - provisioned_product: null
- - service_action: null
  - ExecutesAs
  - automation_role: null
where:
- 'node_type(?service_action) == GenericManagement  # AWS::ServiceCatalog::ServiceAction (SSM Automation
  wrapper)'
- ?service_action is associated with ?provisioned_product (or ?provisioned_product's product)
- ?principal has EFFECTIVE servicecatalog:ExecuteProvisionedProductServiceAction on ?provisioned_product
optional:
- - principal: null
  - CanModifyCode
  - service_action: null
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?automation_role
  permissions:
  - servicecatalog:ExecuteProvisionedProductServiceAction
  conditions:
  - iam_permission
  - service_state
  state_logic: ACTIVE when ?principal has EFFECTIVE servicecatalog:ExecuteProvisionedProductServiceAction
    on the provisioned product AND can trigger it (CanTrigger), and the service action is associated and
    configured. CONDITIONAL(service_state) when the service action association exists but the automation
    role trust or configuration is unverified. BLOCKED when an SCP or permission boundary denies servicecatalog:ExecuteProvisionedProductServiceAction
    at the effective scope, or when the service action is not associated with the product.
  confidence: 0.75
  derived_from:
  - ?principal CanTrigger ?provisioned_product
  - ?service_action ExecutesAs ?automation_role
  - cicd-chains.yaml cicd-trigger-runner-executes-as (trigger + ExecutesAs pattern)
  false_positive_note: "This path executes SSM Automation as a separate identity from the product's launch\
    \ role (rule 1). The automation role is NOT the product's launch role. Verify the service action is\
    \ associated with the product via DescribeProvisioningArtifact or ListProvisioningArtifactParameters\
    \ (ServiceActions field). If the principal can also modify the service action's definition or the\
    \ SSM document it wraps (servicecatalog:UpdateServiceAction, ssm:UpdateDocument, or write to the document\
    \ S3 location), upgrade to ACTIVE \u2014 the principal controls the automation steps."
  narrative: '{principal.name} can trigger provisioned product {provisioned_product.name} (servicecatalog:ExecuteProvisionedProductServiceAction)
    and execute its associated service action {service_action.name}. {service_action.name} runs the SSM
    Automation document as {automation_role.name}, granting {automation_role.name}''s permissions to {principal.name}.
    This is a separate execution path from the product''s launch role.'