aws-ssm-register-maintenance-window-task-workload-as

Register a Run Command / Automation task with a Maintenance Window, binding a privileged service role that the task will run as.

derived aws emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Role`
source	`?principal`
target	`?role`
permissions	`iam:PassRole` `ssm:RegisterTaskWithMaintenanceWindow`
conditions	`role_compatibility` `iam_permission`
state logic	if the ?role trust policy or iam:PassedToService is unknown/unresolved: POTENTIAL(role_compatibility); elif both ssm:RegisterTaskWithMaintenanceWindow and iam:PassRole are ACTIVE: ACTIVE (caller registers a task with a maintenance window that will run at scheduled times as ?role). BLOCKED when an SCP denies ssm:RegisterTaskWithMaintenanceWindow or iam:PassRole.

source type

Identity

target type

Role

source

?principal

target

?role

permissions

iam:PassRole ssm:RegisterTaskWithMaintenanceWindow

conditions

role_compatibility iam_permission

state logic

if the ?role trust policy or iam:PassedToService is unknown/unresolved: POTENTIAL(role_compatibility); elif both ssm:RegisterTaskWithMaintenanceWindow and iam:PassRole are ACTIVE: ACTIVE (caller registers a task with a maintenance window that will run at scheduled times as ?role). BLOCKED when an SCP denies ssm:RegisterTaskWithMaintenanceWindow or iam:PassRole.

Narrative

{principal.name} can pass {role.name} to SSM (iam:PassRole) and register a task with a Maintenance Window (ssm:RegisterTaskWithMaintenanceWindow) that will execute attacker-controlled commands as {role.name} within the window's scheduled timeframe.

Raw rule rules/derived/aws/ssm.yaml

id: aws-ssm-register-maintenance-window-task-workload-as
emits: CanCreateWorkloadAs
description: Register a Run Command / Automation task with a Maintenance Window, binding a privileged
  service role that the task will run as.
match:
- - principal: null
  - CanPassIdentity
  - role: null
where:
- ?principal has EFFECTIVE ssm:RegisterTaskWithMaintenanceWindow (resource scope covers maintenance windows
  or *)
- ?role trust policy allows ssm.amazonaws.com
- iam:PassRole for ?role permits iam:PassedToService including ssm.amazonaws.com (or unconditioned)
emit:
  source_type: Identity
  target_type: Role
  source: ?principal
  target: ?role
  permissions:
  - iam:PassRole
  - ssm:RegisterTaskWithMaintenanceWindow
  conditions:
  - role_compatibility
  - iam_permission
  state_logic: 'if the ?role trust policy or iam:PassedToService is unknown/unresolved: POTENTIAL(role_compatibility);
    elif both ssm:RegisterTaskWithMaintenanceWindow and iam:PassRole are ACTIVE: ACTIVE (caller registers
    a task with a maintenance window that will run at scheduled times as ?role). BLOCKED when an SCP denies
    ssm:RegisterTaskWithMaintenanceWindow or iam:PassRole.'
  confidence: 0.85
  derived_from:
  - ?principal CanPassIdentity ?role
  - effective ssm:RegisterTaskWithMaintenanceWindow
  false_positive_note: 'Honor iam:PassedToService: a role passable only to ec2.amazonaws.com does NOT
    work for Maintenance Window tasks. The role MUST trust ssm.amazonaws.com. The task must reference
    a RunCommand or Automation document; the document''s definition or parameters must be attacker-controllable
    for code execution (either via ssm:UpdateDocument on an existing Automation document, or injected
    parameters on a RunCommand). This edge captures the privilege escalation at workload creation time;
    the trigger (scheduled window) is modeled separately in explicit rules.'
  narrative: '{principal.name} can pass {role.name} to SSM (iam:PassRole) and register a task with a Maintenance
    Window (ssm:RegisterTaskWithMaintenanceWindow) that will execute attacker-controlled commands as {role.name}
    within the window''s scheduled timeframe.'