rage.fail

enter-account-via-assume

Assuming/federating into a role in another account = entering it.

derived aws emits CanEnterAccount

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'attacker': None} CanAssume {'role': None}

where

account_of(?role) != account_of(?attacker)

emit

source type	`Identity`
target type	`Account`
source	`?attacker`
target	`<account of ?role>`
state logic	inherit from CanAssume

Raw rule rules/derived/can-control.yaml

id: enter-account-via-assume
emits: CanEnterAccount
description: Assuming/federating into a role in another account = entering it.
applies_to:
- aws
match:
- - attacker: null
  - CanAssume
  - role: null
where:
- account_of(?role) != account_of(?attacker)
emit:
  source_type: Identity
  target_type: Account
  source: ?attacker
  target: <account of ?role>
  state_logic: inherit from CanAssume
  derived_from:
  - ?attacker CanAssume ?role (cross-account)