aws-ssm-create-association-workload-as

Create a new State Manager association with a privileged role and attacker-controlled document parameters, yielding recurring scheduled code execution as that role.

derived aws emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Role`
source	`?principal`
target	`?role`
permissions	`iam:PassRole` `ssm:CreateAssociation`
conditions	`role_compatibility` `iam_permission`
state logic	if the ?role trust policy or iam:PassedToService is unknown/unresolved: POTENTIAL(role_compatibility); elif both ssm:CreateAssociation and iam:PassRole are ACTIVE: ACTIVE (caller creates a State Manager association with an Automation document that will run on a schedule as ?role). BLOCKED when an SCP denies ssm:CreateAssociation or iam:PassRole.

source type

Identity

target type

Role

source

?principal

target

?role

permissions

iam:PassRole ssm:CreateAssociation

conditions

role_compatibility iam_permission

state logic

if the ?role trust policy or iam:PassedToService is unknown/unresolved: POTENTIAL(role_compatibility); elif both ssm:CreateAssociation and iam:PassRole are ACTIVE: ACTIVE (caller creates a State Manager association with an Automation document that will run on a schedule as ?role). BLOCKED when an SCP denies ssm:CreateAssociation or iam:PassRole.

Narrative

{principal.name} can pass {role.name} to SSM (iam:PassRole), create a new State Manager association (ssm:CreateAssociation) with an Automation document that will run on schedule, executing attacker code as {role.name} automatically on each scheduled tick.

Raw rule rules/derived/aws/ssm.yaml

id: aws-ssm-create-association-workload-as
emits: CanCreateWorkloadAs
description: Create a new State Manager association with a privileged role and attacker-controlled document
  parameters, yielding recurring scheduled code execution as that role.
match:
- - principal: null
  - CanPassIdentity
  - role: null
where:
- ?principal has EFFECTIVE ssm:CreateAssociation (resource scope covers new associations or *)
- ?role trust policy allows ssm.amazonaws.com
- iam:PassRole for ?role permits iam:PassedToService including ssm.amazonaws.com (or unconditioned)
emit:
  source_type: Identity
  target_type: Role
  source: ?principal
  target: ?role
  permissions:
  - iam:PassRole
  - ssm:CreateAssociation
  conditions:
  - role_compatibility
  - iam_permission
  state_logic: 'if the ?role trust policy or iam:PassedToService is unknown/unresolved: POTENTIAL(role_compatibility);
    elif both ssm:CreateAssociation and iam:PassRole are ACTIVE: ACTIVE (caller creates a State Manager
    association with an Automation document that will run on a schedule as ?role). BLOCKED when an SCP
    denies ssm:CreateAssociation or iam:PassRole.'
  confidence: 0.85
  derived_from:
  - ?principal CanPassIdentity ?role
  - effective ssm:CreateAssociation
  false_positive_note: 'Honor iam:PassedToService: a role passable only to ec2.amazonaws.com does NOT
    work for State Manager association runners. The role MUST trust ssm.amazonaws.com. The association
    provides an automatic run path (ScheduleExpression) that makes the created workload ACTIVE unlike
    POTENTIAL. If the association has no schedule or ApplyOnly mode, downgrade to CONDITIONAL(trigger_exists).
    All permissions must be EFFECTIVE; a partial grant leaves the path CONDITIONAL.'
  narrative: '{principal.name} can pass {role.name} to SSM (iam:PassRole), create a new State Manager
    association (ssm:CreateAssociation) with an Automation document that will run on schedule, executing
    attacker code as {role.name} automatically on each scheduled tick.'