rage.fail

execute-as-via-config-identity-swap

Change the execution identity binding of a compute resource to a chosen privileged identity.

derived any cloud emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'attacker': None} CanModifyConfiguration {'compute': None} {'attacker': None} CanPassIdentity {'identity': None}

where

node_class(?compute) in [Compute, AnalyticsService, DataWarehouse, DataLake] NOT (?compute.evasion_only == true) role_compatible(?identity, ?compute)

emit

source type	`Identity`
target type	`Identity`
source	`?attacker`
target	`?identity`
state logic	ACTIVE

Raw rule rules/derived/can-execute-as.yaml

id: execute-as-via-config-identity-swap
emits: CanExecuteAs
description: Change the execution identity binding of a compute resource to a chosen privileged identity.
applies_to:
- '*'
match:
- - attacker: null
  - CanModifyConfiguration
  - compute: null
- - attacker: null
  - CanPassIdentity
  - identity: null
where:
- node_class(?compute) in [Compute, AnalyticsService, DataWarehouse, DataLake]
- NOT (?compute.evasion_only == true)
- role_compatible(?identity, ?compute)
emit:
  source_type: Identity
  target_type: Identity
  source: ?attacker
  target: ?identity
  state_logic: ACTIVE
  derived_from:
  - ?attacker CanModifyConfiguration ?compute
  - ?attacker CanPassIdentity ?identity
  evidence:
    narrative_template: '{attacker.name} can bind {identity.name} to {compute.name} ({perm:CanPassIdentity})
      and modify its configuration, then execute as {identity.name}.

      '