rage.fail

aws-glue-execute-as-update-script

Update a Glue job's ScriptLocation to an attacker-controlled S3 object, establishing the code-modify and trigger facts needed for can-execute-as derivation.

derived aws emits CanModifyCodeCanTrigger

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanModifyCode {'job': None} {'job': None} ExecutesAs {'role': None}

where

node_type(?job) in [BatchJob, Notebook] CanModifyCode comes from glue:UpdateJob (ScriptLocation) or glue:CreateSession code injection

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

{'principal': None} CanTrigger {'job': None}

emit

Raw rule rules/derived/aws/glue.yaml

id: aws-glue-execute-as-update-script
emits:
- CanModifyCode
- CanTrigger
description: Update a Glue job's ScriptLocation to an attacker-controlled S3 object, establishing the
  code-modify and trigger facts needed for can-execute-as derivation.
applies_to:
- aws
match:
- - principal: null
  - CanModifyCode
  - job: null
- - job: null
  - ExecutesAs
  - role: null
where:
- node_type(?job) in [BatchJob, Notebook]
- CanModifyCode comes from glue:UpdateJob (ScriptLocation) or glue:CreateSession code injection
optional:
- - principal: null
  - CanTrigger
  - job: null
note: This rule ensures the prerequisite CanModifyCode and CanTrigger edges are correctly normalized.
  The CanExecuteAs roll-up (principal -> role) is derived via can-execute-as execute-as-via-code-modify
  linchpin (CanModifyCode + ExecutesAs + optional CanTrigger => CanExecuteAs). Do NOT emit CanExecuteAs
  directly here. If a Glue-specific gate (e.g. trigger confirmation) is needed, encode it as a condition
  annotation on the CanModifyCode edge.
false_positive_note: 'CanModifyCode here is via glue:UpdateJob changing ScriptLocation; do not conflate
  with glue:UpdateJob on non-script fields (those yield CanModifyConfiguration, not CanModifyCode). Honor
  SCP/boundary denying glue:UpdateJob -> BLOCKED. Citation: can-execute-as execute-as-via-code-modify
  and cicd-chains cicd-modify-buildspec-executes-as for CanExecuteAs roll-up and CanEscalateTo summary.'