aws-ec2-start-triggers-userdata
match (effective permission)
{
"action": "ec2:StartInstances",
"resource_type": "AWS::EC2::Instance"
}
emit
| source type | Identity |
|---|---|
| target type | Compute |
| source | <principal> |
| target | <EC2 instance> |
| permissions | ec2:StartInstances |
| conditions | service_state |
| state logic | Not an escalation on its own. Contributes to a path ONLY when a CONDITIONAL(service_state) execution edge (e.g. poisoned UserData) exists on the SAME instance; on a clean instance ec2:StartInstances is inert. |
Narrative
{principal.name} can start {instance.name} (ec2:StartInstances), realizing any pending boot-time execution edge (e.g. poisoned UserData) on it.
Raw rule rules/derived/aws/ec2.yaml
id: aws-ec2-start-triggers-userdata
emits: CanStart
match_effective_permission:
action: ec2:StartInstances
resource_type: AWS::EC2::Instance
emit:
source_type: Identity
target_type: Compute
source: <principal>
target: <EC2 instance>
permissions:
- ec2:StartInstances
conditions:
- service_state
note: 'Realizer edge only: CanStart realizes a CONDITIONAL(service_state) execution edge (e.g. poisoned
UserData from aws-ec2-modify-userdata) by forcing the boot that triggers it.'
state_logic: Not an escalation on its own. Contributes to a path ONLY when a CONDITIONAL(service_state)
execution edge (e.g. poisoned UserData) exists on the SAME instance; on a clean instance ec2:StartInstances
is inert.
false_positive_note: On a clean instance StartInstances does nothing an attacker benefits from. Emit/walk
this as an escalation contributor only in the presence of a pending CONDITIONAL execution edge on
the same instance.
narrative: '{principal.name} can start {instance.name} (ec2:StartInstances), realizing any pending boot-time
execution edge (e.g. poisoned UserData) on it.'