aws-sf-can-modify-configuration-role-swap
states:UpdateStateMachine combined with iam:PassRole on a new role allows swapping the execution role to a different IAM identity on an existing state machine.
match (effective permission)
{
"action": "states:UpdateStateMachine",
"resource_type": "AWS::StepFunctions::StateMachine"
}
where
principal also has effective iam:PassRole for at least one IAM role trusted by states.amazonaws.com (or with iam:PassedToService permitting states.amazonaws.com)
emit
| source type | Identity |
|---|---|
| target type | Workflow |
| source | <principal> |
| target | <Step Functions State Machine (Workflow)> |
| permissions | states:UpdateStateMachine iam:PassRole |
| conditions | iam_permission role_compatibility |
| state logic | ACTIVE when the principal has effective states:UpdateStateMachine AND iam:PassRole on a role whose trust policy allows states.amazonaws.com (or iam:PassedToService includes states.amazonaws.com). POTENTIAL(role_compatibility) when iam:PassRole is present but the role trust / PassedToService condition is unknown or unresolved — downgrade until trust is confirmed. |
Narrative
{principal.name} can re-bind state machine {stateMachine.name} to run as a different IAM role (states:UpdateStateMachine + iam:PassRole to states.amazonaws.com); the next execution runs as the new role.
Raw rule rules/derived/aws/stepfunctions.yaml
id: aws-sf-can-modify-configuration-role-swap
emits: CanModifyConfiguration
description: states:UpdateStateMachine combined with iam:PassRole on a new role allows swapping the execution
role to a different IAM identity on an existing state machine.
match_effective_permission:
action: states:UpdateStateMachine
resource_type: AWS::StepFunctions::StateMachine
where:
- principal also has effective iam:PassRole for at least one IAM role trusted by states.amazonaws.com
(or with iam:PassedToService permitting states.amazonaws.com)
emit:
source_type: Identity
target_type: Workflow
source: <principal>
target: <Step Functions State Machine (Workflow)>
permissions:
- states:UpdateStateMachine
- iam:PassRole
conditions:
- iam_permission
- role_compatibility
state_logic: "ACTIVE when the principal has effective states:UpdateStateMachine AND iam:PassRole on\
\ a role whose trust policy allows states.amazonaws.com (or iam:PassedToService includes states.amazonaws.com).\
\ POTENTIAL(role_compatibility) when iam:PassRole is present but the role trust / PassedToService\
\ condition is unknown or unresolved \u2014 downgrade until trust is confirmed."
derived_from:
- effective states:UpdateStateMachine on stateMachine scope
- effective iam:PassRole with states.amazonaws.com
false_positive_note: 'The role-swap aspect of UpdateStateMachine is CanModifyConfiguration (not CanModifyCode):
it changes the execution identity, not the definition. Honor iam:PassedToService: if PassRole is conditioned
on iam:PassedToService = ec2.amazonaws.com only, it does NOT permit passing the role to Step Functions.
The role''s trust policy must include states.amazonaws.com as a trusted service principal for the
swap to succeed. Downgrade to POTENTIAL(role_compatibility) when the trust is uncertain. This feeds
can-execute-as execute-as-via-config-identity-swap which requires CanModifyConfiguration + CanPassIdentity.'
narrative: '{principal.name} can re-bind state machine {stateMachine.name} to run as a different IAM
role (states:UpdateStateMachine + iam:PassRole to states.amazonaws.com); the next execution runs as
the new role.'