aws-lambda-exposes-exec-role-cred
A function leaks its execution-role credentials to any code it runs.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?function) ==
ServerlessFunction
emit
| source | ?function |
|---|---|
| target | ?role |
Narrative
{function.name} exposes the credentials of its execution role {role.name} to any code running inside it.
Raw rule rules/derived/aws/lambda.yaml
id: aws-lambda-exposes-exec-role-cred
emits: ExposesCredential
description: A function leaks its execution-role credentials to any code it runs.
match:
- - function: null
- ExecutesAs
- role: null
where:
- node_type(?function) == ServerlessFunction
emit:
source: ?function
target: ?role
permissions: []
derived_from:
- <ExecutesAs edge_id>
note: Lambda injects role creds as env vars and via the runtime credential relay endpoint (AWS_CONTAINER_CREDENTIALS_FULL_URI);
NOT IMDS. Any attacker code in the function reads them. This edge only becomes an attack step when
combined with a CanModifyCode/Configuration/CanInvoke capability.
false_positive_note: Not an escalation by itself; it expresses the fact that code-execution in the function
equals holding the role's credentials. Path value comes from a contributing execution edge.
narrative: '{function.name} exposes the credentials of its execution role {role.name} to any code running
inside it.'