aws-glue-dev-endpoint-execute-command

Inject an SSH public key into a running Glue development endpoint via glue:UpdateDevEndpoint, gaining OS-level command execution on the Spark cluster host.

derived aws emits CanExecuteCommand

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`VirtualMachine`
source	`?principal`
target	`?endpoint`
permissions	`glue:UpdateDevEndpoint`
conditions	`iam_permission` `service_state` `network_reachability`
state logic	ACTIVE when the endpoint is READY and network_reachability to SSH port (22) is satisfied (network_reachability condition). CONDITIONAL(service_state) if the endpoint is still provisioning. CONDITIONAL(network_reachability) if the endpoint's SG or the attacker's network position blocks SSH. BLOCKED if glue:UpdateDevEndpoint is denied by SCP/boundary.

source type

Identity

target type

VirtualMachine

source

?principal

target

?endpoint

permissions

glue:UpdateDevEndpoint

conditions

iam_permission service_state network_reachability

state logic

ACTIVE when the endpoint is READY and network_reachability to SSH port (22) is satisfied (network_reachability condition). CONDITIONAL(service_state) if the endpoint is still provisioning. CONDITIONAL(network_reachability) if the endpoint's SG or the attacker's network position blocks SSH. BLOCKED if glue:UpdateDevEndpoint is denied by SCP/boundary.

Narrative

{principal.name} can add an attacker SSH public key to development endpoint {endpoint.name} (glue:UpdateDevEndpoint → PublicKey), then SSH into the Spark master and run OS-level commands as the endpoint's IAM role (credentials available from IMDS).

Raw rule rules/derived/aws/glue.yaml

id: aws-glue-dev-endpoint-execute-command
emits: CanExecuteCommand
description: Inject an SSH public key into a running Glue development endpoint via glue:UpdateDevEndpoint,
  gaining OS-level command execution on the Spark cluster host.
applies_to:
- aws
match:
- - principal: null
  - CanModifyConfiguration
  - endpoint: null
where:
- node_type(?endpoint) == VirtualMachine
- CanModifyConfiguration comes from glue:UpdateDevEndpoint (adds PublicKey)
- ?endpoint status is READY (or provisioning)
emit:
  source_type: Identity
  target_type: VirtualMachine
  source: ?principal
  target: ?endpoint
  permissions:
  - glue:UpdateDevEndpoint
  conditions:
  - iam_permission
  - service_state
  - network_reachability
  state_logic: ACTIVE when the endpoint is READY and network_reachability to SSH port (22) is satisfied
    (network_reachability condition). CONDITIONAL(service_state) if the endpoint is still provisioning.
    CONDITIONAL(network_reachability) if the endpoint's SG or the attacker's network position blocks SSH.
    BLOCKED if glue:UpdateDevEndpoint is denied by SCP/boundary.
  confidence: min(contributing_confidences) * 0.9
  derived_from:
  - <CanModifyConfiguration(principal, endpoint) edge_id>
  false_positive_note: "Only ACTIVE for READY endpoints; FAILED / DELETING endpoints provide no SSH access.\
    \ Network reachability to TCP/22 is required \u2014 check the dev endpoint's security group (EndpointSecurityGroupIds)\
    \ and whether PublicAddress is set (public endpoint) or the attacker is within the configured VPC\
    \ subnet (private endpoint). If glue:UpdateDevEndpoint is denied (SCP/permission boundary), mark BLOCKED.\
    \ can-execute-as execute-as-via-command then derives CanExecuteAs(principal -> devRole) off this CanExecuteCommand\
    \ + the endpoint's ExecutesAs edge. Do not re-derive CanExecuteAs here \u2014 cite can-execute-as."
  narrative: "{principal.name} can add an attacker SSH public key to development endpoint {endpoint.name}\
    \ (glue:UpdateDevEndpoint \u2192 PublicKey), then SSH into the Spark master and run OS-level commands\
    \ as the endpoint's IAM role (credentials available from IMDS)."