rage.fail

aws-update-login-profile

derived aws emits CanResetCredential

match (effective permission)

{ "action": "iam:UpdateLoginProfile", "resource_type": "AWS::IAM::User" }

emit

source	`<principal>`
target	`<IAM user w/ console password>`
permissions	`iam:UpdateLoginProfile`

Narrative

{principal.name} can reset the console password of {target.name} (iam:UpdateLoginProfile).

Raw rule rules/derived/aws/identity-escalation.yaml

id: aws-update-login-profile
emits: CanResetCredential
match_effective_permission:
  action: iam:UpdateLoginProfile
  resource_type: AWS::IAM::User
emit:
  source: <principal>
  target: <IAM user w/ console password>
  permissions:
  - iam:UpdateLoginProfile
  narrative: '{principal.name} can reset the console password of {target.name} (iam:UpdateLoginProfile).'