aws-ssm-create-automation-workload-as

Create a new Automation document with attacker-controlled steps and bind a passable privileged role, yielding code execution as that role.

derived aws emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanPassIdentity {'role': None}

where

?principal has EFFECTIVE ssm:CreateDocument (resource scope covers the new document ARN or *) ?principal has EFFECTIVE ssm:StartAutomationExecution (resource scope covers the new document ARN or *) ?role trust policy allows ssm.amazonaws.com (AssumedBy ssm.amazonaws.com) iam:PassRole for ?role permits iam:PassedToService including ssm.amazonaws.com (or unconditioned)

emit

source type	`Identity`
target type	`Role`
source	`?principal`
target	`?role`
permissions	`iam:PassRole` `ssm:CreateDocument` `ssm:StartAutomationExecution`
conditions	`role_compatibility` `iam_permission`
state logic	if the ?role trust policy or iam:PassedToService is unknown/unresolved: POTENTIAL(role_compatibility); elif all three effective permissions are ACTIVE: ACTIVE (caller creates the document, starts execution with AutomationAssumeRole = ?role, and the document's aws:executeScript step runs attacker code as ?role); else CONDITIONAL(iam_permission) for whichever permission is missing. BLOCKED when an SCP denies ssm:CreateDocument or iam:PassRole.

Narrative

{principal.name} can pass {role.name} to SSM Automation (iam:PassRole to ssm.amazonaws.com), create a new document with attacker-controlled steps (ssm:CreateDocument), and execute it (ssm:StartAutomationExecution), running attacker code as {role.name}.

Raw rule rules/derived/aws/ssm.yaml

id: aws-ssm-create-automation-workload-as
emits: CanCreateWorkloadAs
description: Create a new Automation document with attacker-controlled steps and bind a passable privileged
  role, yielding code execution as that role.
match:
- - principal: null
  - CanPassIdentity
  - role: null
where:
- ?principal has EFFECTIVE ssm:CreateDocument (resource scope covers the new document ARN or *)
- ?principal has EFFECTIVE ssm:StartAutomationExecution (resource scope covers the new document ARN or
  *)
- ?role trust policy allows ssm.amazonaws.com (AssumedBy ssm.amazonaws.com)
- iam:PassRole for ?role permits iam:PassedToService including ssm.amazonaws.com (or unconditioned)
emit:
  source_type: Identity
  target_type: Role
  source: ?principal
  target: ?role
  permissions:
  - iam:PassRole
  - ssm:CreateDocument
  - ssm:StartAutomationExecution
  conditions:
  - role_compatibility
  - iam_permission
  state_logic: 'if the ?role trust policy or iam:PassedToService is unknown/unresolved: POTENTIAL(role_compatibility);
    elif all three effective permissions are ACTIVE: ACTIVE (caller creates the document, starts execution
    with AutomationAssumeRole = ?role, and the document''s aws:executeScript step runs attacker code as
    ?role); else CONDITIONAL(iam_permission) for whichever permission is missing. BLOCKED when an SCP
    denies ssm:CreateDocument or iam:PassRole.'
  confidence: 0.9
  derived_from:
  - ?principal CanPassIdentity ?role
  - effective ssm:CreateDocument
  - effective ssm:StartAutomationExecution
  false_positive_note: "Honor iam:PassedToService: a role passable only to ec2.amazonaws.com does NOT\
    \ yield SSM Automation execution. The role MUST trust ssm.amazonaws.com or StartAutomationExecution\
    \ fails with an invalid-role error -> downgrade to POTENTIAL(role_compatibility) when trust is unknown.\
    \ All three actions must be EFFECTIVE; a partial grant (e.g. CreateDocument but not StartAutomationExecution)\
    \ leaves the path CONDITIONAL. The aws:executeScript step requires Lambda runtime (Python/PowerShell)\
    \ in the AutomationAssumeRole \u2014 the role needs no specific Lambda permissions but must exist\
    \ and trust SSM."
  narrative: '{principal.name} can pass {role.name} to SSM Automation (iam:PassRole to ssm.amazonaws.com),
    create a new document with attacker-controlled steps (ssm:CreateDocument), and execute it (ssm:StartAutomationExecution),
    running attacker code as {role.name}.'