CanPassIdentity
Source may attach/pass the target identity to a NEW or existing workload (prereq for CanExecuteAs).
Identity
── CanPassIdentity ──▸
Role, ServiceAccount, ManagedIdentity, MachineIdentity, VirtualMachine
Source types
IdentityStates
ACTIVE
CONDITIONAL
POTENTIAL
BLOCKED
UNKNOWN
Derivation
| nature | explicit |
|---|---|
| conditions | iam_permission condition_expression role_compatibility |
Per-cloud
| cloud | permissions / triggers | note |
|---|---|---|
| aws |
iam:PassRole
|
Scoped by resource + often service condition. |
| gcp |
iam.serviceAccounts.actAs
|
|
| azure | - | Assigning a user-assigned MI / setting SP on a resource; requires Microsoft.ManagedIdentity/.../assign + write on target. |
Rules that emit CanPassIdentity 47
iam:PassRole scoped to amplify.amazonaws.com lets a principal attach a service role to an Amplify App.
awsderived
iam:PassRole scoped to App Runner lets a principal attach an instance/access role.
awsderived
Caller can pass an instance-profile role to EC2 through an Auto Scaling launch template/config.
awsderived
Create a launch configuration that embeds a privileged instance profile, then point an ASG at it.
awsderived
awsderived
awsderived
awsderived
iam:PassRole to codebuild.amazonaws.com lets the principal assign any passable role as the project service role (via CreateProject or UpdateProject).
awsderived
iam:PassRole on a role that trusts ec2.amazonaws.com lets the principal bind it as the resourceRole in a Data Pipeline definition, enabling code running on the EC2/EMR node to execute as that role.
awsderived
iam:PassRole on a role that trusts datapipeline.amazonaws.com lets the principal bind it as the pipeline role, used by the Data Pipeline service to provision EC2/EMR resources and access downstream AWS services.
awsderived
Principal can pass a role to ECS tasks (iam:PassRole scoped to ecs-tasks).
awsderived
awsderived
iam:PassRole to kafkaconnect.amazonaws.com allows the principal to bind any passable role to an MSK Connect connector.
awsderived
iam:PassRole to kafka.amazonaws.com allows the principal to bind any passable role as the replication execution role of a new MSK Replicator.
awsderived
Assigning a user-assigned MI to an ACR Task requires both tasks/write AND MI assign/action.
azurederived
Principal holds assign/action on a UAMI and deploymentScripts/write - can bind the UAMI to a new or existing deploymentScript, making it the script's execution identity.
azurederived
DevOps 'Manage service endpoints' permission lets a principal create a new service connection embedding a chosen Entra SP's credentials, enabling identity-swap escalation paths.
azurederived
azurederived
Azure PassRole analog for the SF application plane: assign/action on a user-assigned MI lets the principal pass that MI to a workload.
azurederived
azurederived
gcpderived
gcpderived
actAs on a SA that the principal names in an HTTP job's oidcToken.serviceAccountEmail or oauthToken.serviceAccountEmail is the GCP PassRole analog for Cloud Scheduler. Required to create or update a job with an authenticated HTTP target.
gcpderived
actAs on a SA that the principal can configure as the trigger's serviceAccount is the GCP PassRole analog for Eventarc trigger SA assignment.
gcpderived
gcpderived
gcpderived
pubsub.subscriptions.create (or pubsub.subscriptions.update) + iam.serviceAccounts.actAs on a push SA allows creating a push subscription that delivers the SA's OIDC token to a push endpoint, attaching the SA's identity to the event source.
gcpderived
cloudtasks.queues.update + iam.serviceAccounts.actAs on a SA allows an attacker to configure that SA as the queue-level OIDC/OAuth token identity - the GCP actAs guard rail for Cloud Tasks queue-SA attachment.
gcpderived
cloudtasks.tasks.create with a per-task httpRequest.oidcToken.serviceAccountEmail (or oauthToken) requires iam.serviceAccounts.actAs on the chosen SA - the per-task identity override path.
gcpderived
actAs on a SA that the principal can attach to a workflow (create/update) is the GCP PassRole analog for Workflows.
gcpderived
iam:PassRole for the EMR instance profile / JobFlowRole, required by RunJobFlow.
awsexplicit
iam:PassRole for the EMR Serverless executionRoleArn, required by StartJobRun.
awsexplicit
iam:PassRole for the EMR ServiceRole (elasticmapreduce.amazonaws.com), required by RunJobFlow.
awsexplicit
iam:PassRole for the EMR on EKS job execution role, required by emrcontainers:StartJobRun.
awsexplicit
awsexplicit
opsworks:CloneStack + iam:PassRole on a privileged role lets a principal create a cloned stack running as that role.
awsexplicit
iam:PassRole for opsworks.amazonaws.com (service role) or ec2.amazonaws.com (instance profile) plus opsworks:CreateStack or opsworks:UpdateStack lets a principal bind a chosen role to a stack.
awsexplicit
quicksight:UpdateAccountSettings + iam:PassRole (to quicksight.amazonaws.com) lets an attacker swap the QuickSight service role.
awsexplicit
iam:PassRole to sagemaker.amazonaws.com for notebook instance creation.
awsexplicit
iam:PassRole to sagemaker.amazonaws.com for training/processing/hyperparameter-tuning/compilation job creation.
awsexplicit
iam:PassRole to sagemaker.amazonaws.com for pipeline creation, giving attacker-controlled pipeline steps the passed role's credentials.
awsexplicit
iam:PassRole to sagemaker.amazonaws.com for model creation, binding a role to be used at serving/transform time.
awsexplicit
iam:PassRole to sagemaker.amazonaws.com for MLflow tracking server role updates.
awsexplicit
azureexplicit
Submit a job specifying identity.client_id to override the cluster-default MI with a chosen user-assigned MI for that run.
azureexplicit
Principal holds iam.serviceAccounts.actAs on a service account (explicit permission normalization).
gcpexplicit
iam.serviceAccounts.actAs on a target SA enables re-binding which SA a scheduled query runs as.
gcpexplicit