security1 publisher
Scoped identity with iam:PassRole could potentially run as prod-admin via a Lambda function it creates, if unblocked by policy controls
Permission-by-permission review scores iam:PassRole, lambda:CreateFunction and lambda:InvokeFunction as controlled access, while path analysis sees one route to whatever the passed role holds. Three policy layers decide whether that route is live.
Publishers:scworld.com
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap+8
- Incentives50
- Confidence55