aws-sagemaker-exposes-exec-role-cred
SageMaker compute surfaces (notebook/training/processing job/pipeline/Studio app) expose execution-role credentials to all code running inside them via IMDS or the container credentials endpoint.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?compute) in [
Notebook, BatchJob, Workflow, ApplicationPlatform]
?compute is a SageMaker resource (provider_type starts with AWS::SageMaker::)
emit
| source type | Compute |
|---|---|
| target type | MachineIdentity |
| source | ?compute |
| target | ?role |
Narrative
{compute.name} exposes the credentials of its execution role {role.name} to any code running inside it (IMDS / container credentials endpoint).
Raw rule rules/derived/aws/sagemaker.yaml
id: aws-sagemaker-exposes-exec-role-cred
emits: ExposesCredential
description: SageMaker compute surfaces (notebook/training/processing job/pipeline/Studio app) expose
execution-role credentials to all code running inside them via IMDS or the container credentials endpoint.
match:
- - compute: null
- ExecutesAs
- role: null
where:
- node_type(?compute) in [Notebook, BatchJob, Workflow, ApplicationPlatform]
- ?compute is a SageMaker resource (provider_type starts with AWS::SageMaker::)
emit:
source_type: Compute
target_type: MachineIdentity
source: ?compute
target: ?role
permissions: []
derived_from:
- '<ExecutesAs edge: compute -> role>'
false_positive_note: 'Not an escalation by itself; this expresses the structural fact that code-execution
in the compute resource equals holding the role''s credentials. Attack value comes from combining
this with a CanModifyCode / presigned URL / CanTrigger edge. Emit source_type dynamically from node_type(?compute):
Notebook for Notebooks, BatchJob for Training/Processing jobs, Workflow for Pipelines, ApplicationPlatform
for MLflow servers. Notebook instances use IMDS (169.254.169.254); training and processing jobs use
the SageMaker training toolkit credential injection or the ECS-compatible container credentials endpoint.'
narrative: '{compute.name} exposes the credentials of its execution role {role.name} to any code running
inside it (IMDS / container credentials endpoint).'