rage.fail

aws-ssm-params-escalate-via-secret

Reading a SecureString that holds creds for a more-privileged identity is escalation.

derived aws emits CanEscalateTo

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanReadSecret {'param': None} {'param': None} CredentialsFor {'target': None}

where

node_class(?param) == Secret ?param.origin_service == aws:ssm-params ?target.privilege_level > ?principal.privilege_level

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`?target`
permissions	`ssm:GetParameter` `kms:Decrypt`
conditions	`key_permission`
state logic	inherit the state of the contributing CanReadSecret (ACTIVE or CONDITIONAL(key_permission)); only emit when ?target is strictly more privileged

Narrative

{principal.name} can escalate to {target.name} by reading credentials stored in the SecureString {param.name}.

Raw rule rules/derived/aws/ssm-params.yaml

id: aws-ssm-params-escalate-via-secret
emits: CanEscalateTo
description: Reading a SecureString that holds creds for a more-privileged identity is escalation.
match:
- - principal: null
  - CanReadSecret
  - param: null
- - param: null
  - CredentialsFor
  - target: null
where:
- node_class(?param) == Secret
- ?param.origin_service == aws:ssm-params
- ?target.privilege_level > ?principal.privilege_level
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?target
  permissions:
  - ssm:GetParameter
  - kms:Decrypt
  conditions:
  - key_permission
  state_logic: inherit the state of the contributing CanReadSecret (ACTIVE or CONDITIONAL(key_permission));
    only emit when ?target is strictly more privileged
  confidence: min(contributing_confidences) * 0.9
  derived_from:
  - <CanReadSecret edge_id>
  - <CredentialsFor edge_id>
  false_positive_note: 'Only emit when the credential''s target identity is strictly more privileged than
    the reader; a lateral same-privilege credential is not escalation. Inherits the key_permission gate:
    if CanReadSecret is CONDITIONAL(key_permission), so is this.'
  narrative: '{principal.name} can escalate to {target.name} by reading credentials stored in the SecureString
    {param.name}.'