aws-eks-update-nodegroup-config-code-control
eks:UpdateNodegroupConfig allows modifying an existing node group's launch template and scaling configuration. An attacker with this permission can supply a custom launch template with an attacker-controlled AMI or user-data, gaining CanModifyCode on nodes that cycle through the new template.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?principal has EFFECTIVE eks:UpdateNodegroupConfig on ?cluster
node_type(?cluster) ==
KubernetesCluster
emit
| source type | Identity |
|---|---|
| target type | KubernetesCluster |
| source | ?principal |
| target | ?cluster |
| permissions | eks:UpdateNodegroupConfig |
| conditions | iam_permission service_state |
| state logic | CONDITIONAL(service_state) — the principal can modify an existing node group's launch template to point to an attacker-controlled AMI or user-data. The CanModifyCode consequence is realized only when existing nodes are cycled (drained, replaced, or restarted) to pick up the new launch template. Until a node replacement occurs, the modification has no effect on running nodes. BLOCKED if an SCP denies eks:UpdateNodegroupConfig. |
Narrative
{principal.name} holds eks:UpdateNodegroupConfig on cluster {cluster.name}. It can update the launch template of an existing managed node group to point to an attacker-controlled AMI or user-data script, gaining code execution on nodes as they cycle through the new configuration (on drain/replace/scale-up).
Raw rule rules/derived/aws/eks.yaml
id: aws-eks-update-nodegroup-config-code-control
emits: CanModifyConfiguration
description: eks:UpdateNodegroupConfig allows modifying an existing node group's launch template and scaling
configuration. An attacker with this permission can supply a custom launch template with an attacker-controlled
AMI or user-data, gaining CanModifyCode on nodes that cycle through the new template.
match:
- - principal: null
- HasPermission
- cluster: null
where:
- ?principal has EFFECTIVE eks:UpdateNodegroupConfig on ?cluster
- node_type(?cluster) == KubernetesCluster
emit:
source_type: Identity
target_type: KubernetesCluster
source: ?principal
target: ?cluster
permissions:
- eks:UpdateNodegroupConfig
conditions:
- iam_permission
- service_state
state_logic: "CONDITIONAL(service_state) \u2014 the principal can modify an existing node group's launch\
\ template to point to an attacker-controlled AMI or user-data. The CanModifyCode consequence is realized\
\ only when existing nodes are cycled (drained, replaced, or restarted) to pick up the new launch\
\ template. Until a node replacement occurs, the modification has no effect on running nodes. BLOCKED\
\ if an SCP denies eks:UpdateNodegroupConfig."
confidence: 0.8
derived_from:
- eks:UpdateNodegroupConfig effective permission on ?cluster
false_positive_note: 'The attack value is conditional on node cycling: immediately after the config
update, running nodes continue to execute the old AMI/user-data. Only on next scale-up, node replacement,
or forced drain does the new launch template apply. Feeds can-control escalate-via-execute-as for
the node role privilege escalation. Honor SCP denial. Do not emit ACTIVE for this capability alone;
the state is CONDITIONAL(service_state) pending a node replacement trigger.'
narrative: '{principal.name} holds eks:UpdateNodegroupConfig on cluster {cluster.name}. It can update
the launch template of an existing managed node group to point to an attacker-controlled AMI or user-data
script, gaining code execution on nodes as they cycle through the new configuration (on drain/replace/scale-up).'