aws-quicksight-admin-promotion

id: aws-quicksight-admin-promotion
emits: CanGrantPermission
description: quicksight:RegisterUser + quicksight:UpdateUser (role=ADMIN) lets an attacker promote themselves
  or others to QuickSight admin, gaining read access to all datasets, dashboards, and data source configurations.
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - p1: null
- - principal: null
  - HasPermission
  - p2: null
where:
- ?p1.action == 'quicksight:RegisterUser'
- ?p2.action == 'quicksight:UpdateUser'
- ?p2.action_parameters.Role allows 'ADMIN'
- ?quicksight_account is the QuickSight Account/Namespace node
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?quicksight_account
  permissions:
  - quicksight:RegisterUser
  - quicksight:UpdateUser
  conditions:
  - iam_permission
  state_logic: ACTIVE when principal has both quicksight:RegisterUser and quicksight:UpdateUser with the
    role parameter permitting ADMIN promotion. CONDITIONAL(iam_permission) if one of the permissions is
    missing or CONDITIONAL. BLOCKED if either permission is denied by SCP or permission boundary.
  confidence: min(contributing_confidences) * 0.90
  derived_from: []
  false_positive_note: QuickSight admin is scoped to QuickSight only; it does NOT grant AWS IAM admin
    or downstream service access. However, a QuickSight admin can read all datasets, dashboards, and data
    source configurations (including stored credentials metadata) within the QuickSight namespace. To
    achieve data exfiltration, the attacker must also have or escalate to the QuickSight service role
    or possess credentials for the backend data sources (which may be readable if the admin can edit the
    data source and export credentials via API or network exfiltration). This is a namespace-scoped privilege
    escalation, not account-level or cross-account escalation.
  narrative: '{principal.name} can register and promote QuickSight users to admin role (quicksight:RegisterUser
    + quicksight:UpdateUser), becoming or promoting to QuickSight admin with read access to all datasets,
    dashboards, and data source configurations in the namespace.'