Principal can pass any role to compute it can launch

What this check finds

A role or user is allowed iam:PassRole on every role (Resource "*", no condition) and at least one action that launches compute with a role (for example ec2:RunInstances, lambda:CreateFunction, ecs:RegisterTaskDefinition, sagemaker:CreateTrainingJob). Together they let it start something running as any role in the account, including an administrator role: privilege escalation in two calls.

Passing looks like: No principal can pass any role to compute it launches.

How to fix it

Scope iam:PassRole to the specific role ARNs the principal launches workloads with, and add a Condition on iam:PassedToService.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More IAM checks

• HighDeprecated or flawed AWS managed policy in use
• HighIAM role allows assumption from anywhere
• HighIAM role with admin privileges can be assumed by unexpected principals
• HighIAM role with s3 listing and get privileges can be assumed by unexpected principals
• HighIAM user access key has not been rotated in over 180 days
• HighIncorrect policy used to attempt to enforce MFA
• HighInline policy allows privilege escalation to admin
• HighPrincipal has an attached policy granting administrative access

All IAM checks