aws-sagemaker-update-pipeline-definition
UpdatePipeline replacing the pipeline definition injects attacker-controlled step code that runs as the pipeline's execution role.
match (effective permission)
{
"action": "sagemaker:UpdatePipeline",
"resource_type": "AWS::SageMaker::Pipeline"
}
emit
| source type | Identity |
|---|---|
| target type | Workflow |
| source | <principal> |
| target | <SageMaker Pipeline> |
| permissions | sagemaker:UpdatePipeline |
| conditions | iam_permission |
Narrative
{principal.name} can rewrite {pipeline.name}'s definition (sagemaker:UpdatePipeline), injecting steps that execute attacker code as the pipeline's execution role on the next StartPipelineExecution.
Raw rule rules/derived/aws/sagemaker.yaml
id: aws-sagemaker-update-pipeline-definition
emits: CanModifyCode
description: UpdatePipeline replacing the pipeline definition injects attacker-controlled step code that
runs as the pipeline's execution role.
match_effective_permission:
action: sagemaker:UpdatePipeline
resource_type: AWS::SageMaker::Pipeline
emit:
source_type: Identity
target_type: Workflow
source: <principal>
target: <SageMaker Pipeline>
permissions:
- sagemaker:UpdatePipeline
conditions:
- iam_permission
false_positive_note: "Modifying the pipeline definition only affects the NEXT execution. If no subsequent\
\ execution is triggered, the code is planted but never runs: emit CONDITIONAL(trigger_exists) unless\
\ the attacker also has sagemaker:StartPipelineExecution. This mirrors cicd-chains rule 1 \u2014 the\
\ pipeline is a CI/CD-style compute surface whose definition the attacker controls. Cite can-execute-as.yaml\
\ (execute-as-via-code-modify) for the CanExecuteAs roll-up; do not re-derive it here."
narrative: '{principal.name} can rewrite {pipeline.name}''s definition (sagemaker:UpdatePipeline), injecting
steps that execute attacker code as the pipeline''s execution role on the next StartPipelineExecution.'