rage.fail

aws-set-default-policy-version

derived aws emits CanModifyPolicy

match (effective permission)

{ "action": "iam:SetDefaultPolicyVersion", "resource_type": "AWS::IAM::Policy" }

emit

source	`<principal>`
target	`<managed policy>`
permissions	`iam:SetDefaultPolicyVersion`

Narrative

{principal.name} can set the default version of {policy.name} (iam:SetDefaultPolicyVersion).

Raw rule rules/derived/aws/identity-escalation.yaml

id: aws-set-default-policy-version
emits: CanModifyPolicy
match_effective_permission:
  action: iam:SetDefaultPolicyVersion
  resource_type: AWS::IAM::Policy
emit:
  source: <principal>
  target: <managed policy>
  permissions:
  - iam:SetDefaultPolicyVersion
  escalation: Roll a policy back to an older, more-permissive version.
  narrative: '{principal.name} can set the default version of {policy.name} (iam:SetDefaultPolicyVersion).'