aws-ec2-create-image
CreateImage from a compromised instance bakes attacker-controlled disk contents into an AMI consumed by future launches (supply chain).
match (effective permission)
{
"action": "ec2:CreateImage",
"resource_type": "AWS::EC2::Instance"
}
where
?principal has EFFECTIVE ec2:CreateImage on a source instance whose disk the attacker controls (post-foothold) OR can register the resulting AMI as a launch source
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <AMI / launch template consumers of the new image> |
| permissions | ec2:CreateImage |
| conditions | iam_permission service_state |
| state logic | ACTIVE only once a downstream consumer (RunInstances/launch-template/ASG) launches from the created AMI; else POTENTIAL(trigger_exists) - creating the image alone runs no code. |
Narrative
{principal.name} can create a new AMI from a controlled instance (ec2:CreateImage), baking attacker code into the image that future launches boot from.
Raw rule rules/derived/aws/ec2.yaml
id: aws-ec2-create-image
emits: CanModifyCode
description: CreateImage from a compromised instance bakes attacker-controlled disk contents into an AMI
consumed by future launches (supply chain).
match_effective_permission:
action: ec2:CreateImage
resource_type: AWS::EC2::Instance
where:
- ?principal has EFFECTIVE ec2:CreateImage on a source instance whose disk the attacker controls (post-foothold)
OR can register the resulting AMI as a launch source
emit:
source_type: Identity
source: <principal>
target: <AMI / launch template consumers of the new image>
permissions:
- ec2:CreateImage
conditions:
- iam_permission
- service_state
escalation: Bake attacker code/backdoors into a new AMI; any future instance launched from it (RunInstances
/ launch template / ASG) boots the poisoned disk, yielding code execution as that instance's role.
state_logic: ACTIVE only once a downstream consumer (RunInstances/launch-template/ASG) launches from
the created AMI; else POTENTIAL(trigger_exists) - creating the image alone runs no code.
false_positive_note: CreateImage snapshots an existing instance's volumes into a new AMI; it is only
a code-poison primitive when the attacker already controls the source instance's disk contents AND
something later launches from the new image. Absent a consumer it is a staged artifact, not execution.
narrative: '{principal.name} can create a new AMI from a controlled instance (ec2:CreateImage), baking
attacker code into the image that future launches boot from.'