aws-asg-modify-userdata-exec
Alter launch template/config UserData or ImageId so newly launched instances execute attacker-controlled boot code.
where
?principal has ec2:CreateLaunchTemplateVersion OR ec2:ModifyLaunchTemplate on a launch template used by an ASG, OR ec2:CreateLaunchTemplate to supply an entirely new template, OR autoscaling:CreateLaunchConfiguration + point an ASG at it
the modified/default/new version becomes the one the ASG launches from
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <launch template / Auto Scaling group> |
| permissions | ec2:CreateLaunchTemplateVersion ec2:ModifyLaunchTemplate ec2:CreateLaunchTemplate autoscaling:CreateLaunchConfiguration |
| conditions | trigger_exists service_state |
Narrative
{principal.name} can set attacker-controlled UserData/AMI in the launch config of ASG {target.name}, running arbitrary code on every newly launched instance.
Raw rule rules/derived/aws/autoscaling.yaml
id: aws-asg-modify-userdata-exec
emits: CanModifyConfiguration
description: Alter launch template/config UserData or ImageId so newly launched instances execute attacker-controlled
boot code.
where:
- ?principal has ec2:CreateLaunchTemplateVersion OR ec2:ModifyLaunchTemplate on a launch template used
by an ASG, OR ec2:CreateLaunchTemplate to supply an entirely new template, OR autoscaling:CreateLaunchConfiguration
+ point an ASG at it
- the modified/default/new version becomes the one the ASG launches from
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <launch template / Auto Scaling group>
permissions:
- ec2:CreateLaunchTemplateVersion
- ec2:ModifyLaunchTemplate
- ec2:CreateLaunchTemplate
- autoscaling:CreateLaunchConfiguration
conditions:
- trigger_exists
- service_state
note: Realized execution occurs on the launched VirtualMachine (aws:ec2); combine with aws-asg-force-launch-trigger
for ACTIVE.
false_positive_note: Only affects future launches. Pinned numbered launch-template versions are not
auto-adopted; and if the caller lacks rights to force a launch, emit CONDITIONAL(trigger_exists).
narrative: '{principal.name} can set attacker-controlled UserData/AMI in the launch config of ASG {target.name},
running arbitrary code on every newly launched instance.'