aws-glue-execute-as-s3-script-poison

Overwrite the S3 object that a Glue job's ScriptLocation references (s3:PutObject), poisoning the ETL code; the next run executes as the job's IAM role.

derived aws emits CanModifyCodeCanTrigger

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

Raw rule rules/derived/aws/glue.yaml

id: aws-glue-execute-as-s3-script-poison
emits:
- CanModifyCode
- CanTrigger
description: Overwrite the S3 object that a Glue job's ScriptLocation references (s3:PutObject), poisoning
  the ETL code; the next run executes as the job's IAM role.
applies_to:
- aws
match:
- - principal: null
  - CanModifyCode
  - job: null
- - job: null
  - ExecutesAs
  - role: null
where:
- node_type(?job) in [BatchJob]
- CanModifyCode comes from s3:PutObject on the ScriptLocation S3 key (supply-chain path, not glue:UpdateJob)
optional:
- - principal: null
  - CanTrigger
  - job: null
note: This rule ensures the prerequisite CanModifyCode and CanTrigger edges are correctly normalized.
  The CanExecuteAs roll-up (principal -> role) is derived via can-execute-as execute-as-via-code-modify
  linchpin (CanModifyCode + ExecutesAs + optional CanTrigger => CanExecuteAs). Do NOT emit CanExecuteAs
  directly here.
false_positive_note: 's3:PutObject must scope to the EXACT S3 key (or prefix that covers it) identified
  in the job''s ScriptLocation. A general S3 write on a different bucket is not this path. S3 versioning
  + object lock on the script bucket can mitigate; check whether object overwrite is possible. The attacker
  does NOT need any glue:* permission for the code-plant step; only a run path (glue:StartJobRun or an
  existing trigger) is needed to realize the execution. Dedupes with rule 1 on (CanExecuteAs, ?principal,
  ?role) via can-execute-as linchpin. Citation: can-execute-as execute-as-via-code-modify for CanExecuteAs
  roll-up.'