aws-ssm-send-command-execute-command

ssm:SendCommand delivers attacker-controlled commands to a managed instance, yielding OS-level execution as root/SYSTEM.

derived aws emits CanExecuteCommand

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`VirtualMachine`
source	`?principal`
target	`?instance`
permissions	`ssm:SendCommand`
conditions	`service_state` `iam_permission`
state logic	ACTIVE when ssm:SendCommand is EFFECTIVE on the instance ARN scope and the instance PingStatus is Online (SSM Agent reachable). CONDITIONAL(service_state) when the instance is registered as managed but PingStatus is not Online (agent connectivity may be missing — VPC endpoint absent, security group, NAT). BLOCKED when an SCP / permission boundary denies ssm:SendCommand at the effective scope.

source type

Identity

target type

VirtualMachine

source

?principal

target

?instance

permissions

ssm:SendCommand

conditions

service_state iam_permission

state logic

ACTIVE when ssm:SendCommand is EFFECTIVE on the instance ARN scope and the instance PingStatus is Online (SSM Agent reachable). CONDITIONAL(service_state) when the instance is registered as managed but PingStatus is not Online (agent connectivity may be missing — VPC endpoint absent, security group, NAT). BLOCKED when an SCP / permission boundary denies ssm:SendCommand at the effective scope.

Narrative

{principal.name} can run arbitrary shell commands on {instance.name} via SSM Run Command (ssm:SendCommand + AWS-RunShellScript/RunPowerShellScript), gaining OS-level command execution as root or SYSTEM without requiring inbound network access.

Raw rule rules/derived/aws/ssm.yaml

id: aws-ssm-send-command-execute-command
emits: CanExecuteCommand
description: ssm:SendCommand delivers attacker-controlled commands to a managed instance, yielding OS-level
  execution as root/SYSTEM.
match:
- - principal: null
  - HasPermission
  - instance: null
where:
- effective_action == 'ssm:SendCommand'
- node_type(?instance) == VirtualMachine
- '?instance.ssm_ping_status == ''Online''  # instance is SSM-managed and reachable'
emit:
  source_type: Identity
  target_type: VirtualMachine
  source: ?principal
  target: ?instance
  permissions:
  - ssm:SendCommand
  conditions:
  - service_state
  - iam_permission
  state_logic: "ACTIVE when ssm:SendCommand is EFFECTIVE on the instance ARN scope and the instance PingStatus\
    \ is Online (SSM Agent reachable). CONDITIONAL(service_state) when the instance is registered as managed\
    \ but PingStatus is not Online (agent connectivity may be missing \u2014 VPC endpoint absent, security\
    \ group, NAT). BLOCKED when an SCP / permission boundary denies ssm:SendCommand at the effective scope."
  confidence: 0.95
  derived_from:
  - effective ssm:SendCommand on ?instance
  false_positive_note: "Honor the resource scope: a grant scoped by ssm:resourceTag (e.g. tag:Env=dev)\
    \ does NOT cover instances without that tag. Emit only for instances confirmed Online in ssm:DescribeInstanceInformation.\
    \ AWS-managed documents (AWS-RunShellScript, AWS-RunPowerShellScript) can be specified at call time\
    \ \u2014 the commands parameter is fully attacker-controlled, making this functionally equivalent\
    \ to CanModifyCode for the specific invocation. A grant scoped to tag:Env=* or a very broad resource\
    \ ARN means the attacker can target every managed instance in scope \u2014 scale confidence to 0.95\
    \ for each in-scope instance."
  narrative: '{principal.name} can run arbitrary shell commands on {instance.name} via SSM Run Command
    (ssm:SendCommand + AWS-RunShellScript/RunPowerShellScript), gaining OS-level command execution as
    root or SYSTEM without requiring inbound network access.'