aws-opsworks-instance-exposes-profile-cred

An OpsWorks-managed EC2 instance exposes its instance profile role credentials to any code that runs on it (via IMDS).

derived aws emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`VirtualMachine`
target type	`MachineIdentity`
source	`?instance`
target	`?role`
conditions	`service_state`
state logic	ACTIVE when the instance is in ONLINE/running state (Chef agent responsive, IMDS accessible). CONDITIONAL(service_state) during setup/configure lifecycle. Do not emit when the instance is stopped, terminated, or in a state where IMDS is unreachable.

source type

VirtualMachine

target type

MachineIdentity

source

?instance

target

?role

conditions

service_state

state logic

ACTIVE when the instance is in ONLINE/running state (Chef agent responsive, IMDS accessible). CONDITIONAL(service_state) during setup/configure lifecycle. Do not emit when the instance is stopped, terminated, or in a state where IMDS is unreachable.

Narrative

{instance.name} exposes the instance profile role {role.name} credentials to any code running on it (via EC2 IMDS); a deployment (execute_recipes, run_command) or SSH session on this instance can read and exfiltrate those credentials.

Raw rule rules/derived/aws/opsworks.yaml

id: aws-opsworks-instance-exposes-profile-cred
emits: ExposesCredential
description: An OpsWorks-managed EC2 instance exposes its instance profile role credentials to any code
  that runs on it (via IMDS).
match:
- - instance: null
  - ExecutesAs
  - role: null
where:
- node_type(?instance) == VirtualMachine
- ?instance is an OpsWorks-managed EC2 instance (tagged or classified as AWS::OpsWorks::Instance)
- ?instance.service_state in [ONLINE, running]
emit:
  source_type: VirtualMachine
  target_type: MachineIdentity
  source: ?instance
  target: ?role
  permissions: []
  conditions:
  - service_state
  state_logic: ACTIVE when the instance is in ONLINE/running state (Chef agent responsive, IMDS accessible).
    CONDITIONAL(service_state) during setup/configure lifecycle. Do not emit when the instance is stopped,
    terminated, or in a state where IMDS is unreachable.
  confidence: 0.95
  derived_from:
  - ?instance ExecutesAs ?role
  false_positive_note: Not an escalation by itself; it expresses that code running in a deployment or
    via SSH on the instance can read the instance profile role token from IMDS. Unlike Lambda, OpsWorks
    instances ARE EC2 instances with standard IMDS; the IMDSv2 hop limit does not protect against on-instance
    code (the hop limit is for network-adjacent callers). Do not emit if the instance is stopped/terminated.
    Attack path value comes from a contributing CanModifyCode / CanExecuteCommand edge.
  narrative: '{instance.name} exposes the instance profile role {role.name} credentials to any code running
    on it (via EC2 IMDS); a deployment (execute_recipes, run_command) or SSH session on this instance
    can read and exfiltrate those credentials.'