aws-batch-execute-as-register-submit
Register a job definition with attacker code + a passed privileged jobRole, then submit it.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
{'principal': None}
CanModifyCode {'jobdef': None}
{'principal': None} CanPassIdentity {'jobrole': None}
where
?principal has EFFECTIVE batch:SubmitJob on a job-queue
?jobrole passable to ecs-tasks.amazonaws.com (PassedToService satisfied)
?jobrole.privilege_level >= ?principal.privilege_level
optional
Present → upgrade the emitted state; absent → downgrade (not a hard requirement).
{'principal': None}
CanInvoke {'jobdef': None}
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | ?principal |
| target | ?jobrole |
| permissions | batch:RegisterJobDefinition iam:PassRole batch:SubmitJob |
| state logic | ACTIVE if batch:SubmitJob on a queue is present else CONDITIONAL(iam_permission) |
Narrative
{principal.name} can register a Batch job definition it controls, pass privileged role {jobrole.name} to it, and submit it - executing arbitrary code as {jobrole.name}.
Raw rule rules/derived/aws/batch.yaml
id: aws-batch-execute-as-register-submit
emits: CanExecuteAs
description: Register a job definition with attacker code + a passed privileged jobRole, then submit it.
match:
- - principal: null
- CanModifyCode
- jobdef: null
- - principal: null
- CanPassIdentity
- jobrole: null
where:
- ?principal has EFFECTIVE batch:SubmitJob on a job-queue
- ?jobrole passable to ecs-tasks.amazonaws.com (PassedToService satisfied)
- ?jobrole.privilege_level >= ?principal.privilege_level
optional:
- - principal: null
- CanInvoke
- jobdef: null
emit:
source_type: Identity
target_type: Identity
source: ?principal
target: ?jobrole
permissions:
- batch:RegisterJobDefinition
- iam:PassRole
- batch:SubmitJob
state_logic: ACTIVE if batch:SubmitJob on a queue is present else CONDITIONAL(iam_permission)
conditions_from:
- jobdef: null
- jobrole: null
false_positive_note: Do not emit if PassedToService excludes ecs-tasks, or if batch:Privileged/batch:Image
conditions neutralize the payload. Escalation only when jobRole is more privileged than the attacker.
derived_from:
- CanModifyCode
- CanPassIdentity
narrative: "{principal.name} can register a Batch job definition it controls, pass privileged role {jobrole.name}\
\ to it, and submit it \u2014 executing arbitrary code as {jobrole.name}."