aws-emr-exposes-instance-profile-cred-explicit
Every EC2 node in an EMR cluster exposes the instance profile (JobFlowRole) credentials via the EC2 Instance Metadata Service (IMDS); any code running on the cluster can retrieve them.
match (record)
{
"field": "Cluster.Ec2InstanceAttributes.IamInstanceProfile",
"resource_type": "AWS::EMR::Cluster"
}
where
cluster state is RUNNING or WAITING
emit
| source type | AnalyticsService |
|---|---|
| target type | Identity |
| source | <EMR Cluster> |
| target | <JobFlowRole (instance profile role)> |
| conditions | service_state |
Narrative
EMR cluster {cluster.name} exposes the credentials of its instance profile role {role.name} via IMDS (http://169.254.169.254) on every EC2 node; any code executing on the cluster (including submitted steps) can retrieve those credentials without additional permissions.
Raw rule rules/explicit/aws-emr.yaml
id: aws-emr-exposes-instance-profile-cred-explicit
emits: ExposesCredential
description: Every EC2 node in an EMR cluster exposes the instance profile (JobFlowRole) credentials via
the EC2 Instance Metadata Service (IMDS); any code running on the cluster can retrieve them.
match_record:
resource_type: AWS::EMR::Cluster
field: Cluster.Ec2InstanceAttributes.IamInstanceProfile
where:
- cluster state is RUNNING or WAITING
emit:
source_type: AnalyticsService
target_type: Identity
source: <EMR Cluster>
target: <JobFlowRole (instance profile role)>
state: ACTIVE
conditions:
- service_state
api_source: elasticmapreduce:DescribeCluster
evidence_field: Cluster.Ec2InstanceAttributes.IamInstanceProfile
false_positive_note: "This is a structural fact: the IMDS credential-exposure is inherent to EMR EC2\
\ clusters. It is not an escalation by itself \u2014 it becomes an attack step when combined with\
\ a CanModifyCode/AddJobFlowSteps edge (code gets on the cluster and reads IMDS). Do not BLOCK solely\
\ on IMDSv2 \u2014 downgrade to CONDITIONAL(condition_expression) only when IMDSv2 hop-limit=1 is\
\ confirmed on all nodes. EMR Serverless does NOT use IMDS; this rule does not apply to Serverless\
\ job runs."
narrative: EMR cluster {cluster.name} exposes the credentials of its instance profile role {role.name}
via IMDS (http://169.254.169.254) on every EC2 node; any code executing on the cluster (including
submitted steps) can retrieve those credentials without additional permissions.