Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
Control of a parent administrative boundary inherits transitively to every descendant boundary and resource via Contains*.
Delete an Access Analyzer, removing all findings and disabling ongoing IAM access analysis for the zone of trust - a hard delete of a detective control that reduces detection fidelity without granting access (non-walkable edge).
List findings on an Access Analyzer to map which account resources are externally or publicly accessible and which external principals hold access grants - recon that identifies targets for further attack-path traversal.
A management-account principal that can assume OrganizationAccountAccessRole enters the member account as full admin.
An exportable ACM certificate exposes its private key to any principal that can export it.
An exported ACM private key authenticates as the certificate's DNS/TLS server identity.
Cross-account issuance on a CA whose certs are trusted in the owner account enters that account.
Forging a cert to act as a more-privileged identity is privilege escalation.
A CA-issued certificate authenticates as the downstream identity a trust consumer maps it to.
Forging a CA-trusted cert lets the principal act as the downstream identity.
Issue a certificate for an arbitrary subject/SAN signed by the CA's key.
Rewrite the CA resource policy to grant self issuance, then sign as the CA.
Issue a SubordinateCACertificate to create a new issuer chaining to the trusted CA.
UpdateApp + iam:PassRole can replace an Amplify App's iamServiceRoleArn, changing the build execution identity.
UpdateBranch + iam:PassRole can replace an Amplify Branch's computeRoleArn, changing the SSR request-serving identity.
amplify:CreateApp + iam:PassRole creates a new Amplify App bound to a chosen service role.
amplify:CreateWebHook creates an unauthenticated HTTP endpoint that triggers a branch build.
An Amplify App build exposes the service role's session credentials to code running in the build.
amplify:UpdateApp with buildSpec field rewrites the app-level build commands for all branches.
amplify:UpdateBranch with buildSpec field rewrites build commands for a specific branch.
amplify:UpdateApp can change iamServiceRoleArn, env vars, and auto-build config.
amplify:UpdateBranch can change env vars, enableAutoBuild, computeRoleArn, and backend env.