onboard-privesc-technique

name	onboard-privesc-technique
description	Add a single AWS IAM privilege-escalation technique (e.g. from pathfinding.cloud) to cloudsplaining's detection. This skill should be used when the method name and required action list are already decided — it is a pure executor, not a planner. It updates constants.py with TDD, regenerates fixtures with a regression check, and updates the docs.
allowed-tools	Bash(uv run:*), Bash(just:*), Bash(git add:*), Bash(git commit:*), Edit, Read, Write

Onboard Privilege-Escalation Technique

Add one privilege-escalation method to cloudsplaining/shared/constants.py and wire up its test, fixtures, and docs. This is an EXECUTOR: the method name and action list are inputs (decided upstream by triage-github-issue or mega-pipeline phase 0). Do no planning here.

Inputs

• A PascalCase method name, e.g. PassExistingRoleToNewECSService.
• A list of exact lowercase IAM actions, e.g. ["iam:passrole", "ecs:registertaskdefinition", "ecs:createservice"]. Source: research/pathfinding-cloud/proposed-privilege-escalation-methods.py.
• The originating pathfinding path id (for the docs link), if any.

(Below, ACTIONS denotes that action list.)

Workflow (strict TDD)

1. Verify policy_sentry recognizes every action. Wildcard expansion only works for known actions:

   uv run python -c "from policy_sentry.querying.all import get_all_actions; known={a.lower() for a in get_all_actions()}; missing=[a for a in ACTIONS if a.lower() not in known]; import sys; print('MISSING: '+', '.join(missing)) if missing else print('all actions known')"