aws-asg-launchdata-exposes-credential
Reading a launch template/config exposes hardcoded secrets/credentials embedded in UserData or launch data.
match (effective permission)
{
"action": "ec2:DescribeLaunchTemplateVersions",
"resource_type": "AWS::EC2::LaunchTemplate"
}
where
?principal has ec2:DescribeLaunchTemplateVersions OR autoscaling:DescribeLaunchConfigurations at the effective scope
the launch template/config UserData (or other launch data) contains plaintext credential material (
API keys, passwords, tokens, bootstrap secrets)
emit
| source | <launch template / launch configuration> |
|---|---|
| target | <embedded credential> |
| permissions | ec2:DescribeLaunchTemplateVersions autoscaling:DescribeLaunchConfigurations |
| conditions | iam_permission |
Narrative
Launch data of {source.name} exposes an embedded credential readable via ec2:DescribeLaunchTemplateVersions / autoscaling:DescribeLaunchConfigurations.
Raw rule rules/derived/aws/autoscaling.yaml
id: aws-asg-launchdata-exposes-credential
emits: ExposesCredential
description: Reading a launch template/config exposes hardcoded secrets/credentials embedded in UserData
or launch data.
match_effective_permission:
action: ec2:DescribeLaunchTemplateVersions
resource_type: AWS::EC2::LaunchTemplate
where:
- ?principal has ec2:DescribeLaunchTemplateVersions OR autoscaling:DescribeLaunchConfigurations at the
effective scope
- the launch template/config UserData (or other launch data) contains plaintext credential material (API
keys, passwords, tokens, bootstrap secrets)
emit:
source: <launch template / launch configuration>
target: <embedded credential>
permissions:
- ec2:DescribeLaunchTemplateVersions
- autoscaling:DescribeLaunchConfigurations
conditions:
- iam_permission
false_positive_note: Only escalation when the launch data actually contains a live credential; a template
with no embedded secret is inert recon. UserData is returned base64-encoded and may need decoding
before pattern-matching.
narrative: Launch data of {source.name} exposes an embedded credential readable via ec2:DescribeLaunchTemplateVersions
/ autoscaling:DescribeLaunchConfigurations.