aws-sagemaker-update-notebook-lifecycle

id: aws-sagemaker-update-notebook-lifecycle
emits: CanModifyCode
description: UpdateNotebookInstance changing the lifecycle config injects a shell script that runs as
  root on next start, within the notebook's execution role context.
match_effective_permission:
  action: sagemaker:UpdateNotebookInstance
  resource_type: AWS::SageMaker::NotebookInstance
where:
- principal can set or change LifecycleConfigName on the target notebook
emit:
  source_type: Identity
  target_type: Notebook
  source: <principal>
  target: <SageMaker NotebookInstance>
  permissions:
  - sagemaker:UpdateNotebookInstance
  state: CONDITIONAL
  conditions:
  - iam_permission
  - trigger_exists
  false_positive_note: 'Code injection via lifecycle config only executes on the NEXT notebook start.
    Emit CONDITIONAL(trigger_exists): the attacker has injected the config but cannot execute code until
    the notebook is restarted. If the attacker also has sagemaker:StopNotebookInstance + sagemaker:StartNotebookInstance,
    the edge can be upgraded to ACTIVE. The lifecycle config runs as root on the notebook''s EC2 instance,
    which means all code runs with access to the execution role via IMDS.'
  narrative: '{principal.name} can update {notebook.name}''s lifecycle config (sagemaker:UpdateNotebookInstance),
    injecting a shell script that runs as root on the next start and can call AWS APIs as the notebook''s
    execution role.'