aws-datapipeline-escalate-to-role
Executing as a more-privileged Data Pipeline resourceRole or pipeline role is privilege escalation - an ACTIVE CanExecuteAs where the target role outranks the attacker.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?role is reached via a Data Pipeline
CanExecuteAs rule (rule 8 or rule 9 above)
?role.privilege_level > ?principal.privilege_level
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | ?principal |
| target | ?role |
Narrative
{principal.name} can escalate to {role.name} by executing code in a Data Pipeline ShellCommandActivity that runs as {role.name} - the pipeline PassRole RCE or definition-injection chain yields arbitrary code execution as the more-privileged {role.name}.
Raw rule rules/derived/aws/datapipeline.yaml
id: aws-datapipeline-escalate-to-role
emits: CanEscalateTo
description: "Executing as a more-privileged Data Pipeline resourceRole or pipeline role is privilege\
\ escalation \u2014 an ACTIVE CanExecuteAs where the target role outranks the attacker."
match:
- - principal: null
- CanExecuteAs
- role: null
where:
- ?role is reached via a Data Pipeline CanExecuteAs rule (rule 8 or rule 9 above)
- ?role.privilege_level > ?principal.privilege_level
emit:
source_type: Identity
target_type: Identity
source: ?principal
target: ?role
permissions: []
derived_from:
- ?principal CanExecuteAs ?role (aws-datapipeline-execute-as-passrole-rce or aws-datapipeline-execute-as-existing-def)
- "can-control:escalate-via-execute-as (linchpin \u2014 cited not re-derived)"
false_positive_note: "Only emit when the target role is STRICTLY more privileged than the principal;\
\ a lateral same-privilege role is code execution but not escalation. Inherits state from the contributing\
\ CanExecuteAs \u2014 never stronger than ACTIVE. NOTE: This rule CITES the linchpin can-control:escalate-via-execute-as\
\ rather than re-deriving CanEscalateTo. Both the linchpin and this service-level rule may fire on\
\ the same (principal, role) pair. The runtime dedup logic should merge by (edge type, source, target)\
\ to avoid duplication in the output graph. Preferentially emit the higher-evidence Data Pipeline\
\ narrative if both fire."
narrative: "{principal.name} can escalate to {role.name} by executing code in a Data Pipeline ShellCommandActivity\
\ that runs as {role.name} \u2014 the pipeline PassRole RCE or definition-injection chain yields arbitrary\
\ code execution as the more-privileged {role.name}."