AWS Directory Service not checking iam:PassRole on EnableRoleAccess

AWS Directory Service didn't check the iam:PassRole permissions when using the
EnableRoleAccess action. This could have been used for privilege escalation by an
authenticated user with sufficient permissions (ds:EnableRoleAccess), if the
role had a trust policy that allowed use by Directory Service.

action aws check directory escalation iam permissions policy privilege privilege escalation role service trust