rage.fail

aws-update-assume-role-policy

derived aws emits CanModifyTrust

match (effective permission)

{ "action": "iam:UpdateAssumeRolePolicy", "resource_type": "AWS::IAM::Role" }

emit

source type	`Identity`
source	`<principal>`
target	`<IAM role in scope>`
permissions	`iam:UpdateAssumeRolePolicy` `sts:AssumeRole?`
state logic	ACTIVE if sts:AssumeRole also allowed else CONDITIONAL(needs assume)

Narrative

{principal.name} can rewrite the trust policy of {role.name} (iam:UpdateAssumeRolePolicy) to trust itself and then assume it.

Raw rule rules/derived/aws/identity-escalation.yaml

id: aws-update-assume-role-policy
emits: CanModifyTrust
match_effective_permission:
  action: iam:UpdateAssumeRolePolicy
  resource_type: AWS::IAM::Role
optional_permission: sts:AssumeRole
emit:
  source_type: Identity
  source: <principal>
  target: <IAM role in scope>
  permissions:
  - iam:UpdateAssumeRolePolicy
  - sts:AssumeRole?
  escalation: Rewrite a privileged role's trust policy to allow the attacker, then assume it.
  state_logic: ACTIVE if sts:AssumeRole also allowed else CONDITIONAL(needs assume)
  narrative: '{principal.name} can rewrite the trust policy of {role.name} (iam:UpdateAssumeRolePolicy)
    to trust itself and then assume it.'