Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
A management-account principal that can assume OrganizationAccountAccessRole enters the member account as full admin.
Cross-account issuance on a CA whose certs are trusted in the owner account enters that account.
A cross-account principal that can start or modify a CodeBuild build gains a foothold in the project's account via the service role.
cloudformation:CreateStackInstances / UpdateStackSet in the admin account deploys to target accounts, executing as the StackSet execution role there - a cross-account foothold.
A principal with cloudfront:CreateDistribution can create new distributions pointing at any origin (S3 bucket, ALB, API Gateway, custom endpoint). If an S3 bucket has an overly-broad OAC policy grant (missing aws:SourceArn condition), the attacker can create a distribution to expose its contents publicly.
Principal with cloudtrail:LookupEvents can query 90 days of account-wide management-event history without S3 access, exposing IAM principal names, access-key IDs, resource ARNs, and error codes - useful for recon and lateral movement planning.
Creating a managed account via Account Factory yields a new account pre-seeded with an admin role the creator can assume - creation is entry.
A management-account principal that can assume AWSControlTowerExecution enters every enrolled member account as administrator.
A Direct Connect Gateway-to-TransitGateway association spanning account boundaries establishes network-layer trust (on-prem has routed path into remote account's VPCs).
DocumentDB cluster snapshot is shared for restore with a specific external AWS account via rds:DescribeDBClusterSnapshotAttributes (restore attribute contains account ID).
A principal in the snapshot's restore-authorized account with rds:RestoreDBClusterFromSnapshot can restore a shared DocumentDB cluster snapshot to a new cluster, obtaining full read access to all original data without network access to the source cluster.
An EventBridge custom bus resource policy granting events:PutEvents to a principal in another account establishes cross-account publish trust; the external principal can inject events that trigger compute consumers in this account.
A snapshot is shared to an external AWS account via ec2:DescribeSnapshotAttribute.
A principal with ecr:PutReplicationConfiguration can change the registry's replication destination settings, enabling supply-chain image interception and poisoning across all repositories in the account.
An EFS file system with no explicit file system policy (PolicyNotFound) is fully accessible to any same-account IAM principal that can network-reach the mount target.
A Kinesis stream resource policy granting kinesis:PutRecord(s) to a principal in another account is cross-account publish trust, enabling that external principal to trigger the stream's Lambda consumer.
A Kinesis stream resource policy granting read actions (GetRecords/GetShardIterator/SubscribeToShard) to a foreign account enables that account to read the stream's records, supporting data exfiltration.
Cross-account decrypt that unlocks THIS account's credentials is an account foothold.
An external principal permitted by the key policy/grant can use the key cross-account.
Cross-account principal that can run code in a function enters this account.
An LF admin (or GRANT OPTION holder) granting Lake Formation SELECT / INSERT / DATA_LOCATION_ACCESS to a principal ARN in a foreign AWS account creates cross- account data-lake trust: the external principal can query this account's governed data via their own analytics services.
An MSK cluster resource-based policy granting kafka-cluster:WriteData or ReadData to a principal in another account is cross-account publish/consume trust; feeds messaging-chains rule 4 and can-control's CanEnterAccount derivation.
Neptune cluster snapshot with public restore attribute (restore=all) is immediately exfiltrable by any AWS account via RestoreDBClusterFromSnapshot.
Neptune cluster snapshot is shared for restore with a specific external AWS account via neptune:DescribeDBClusterSnapshotAttributes (restore attribute contains account ID).
Neptune cluster snapshot with public restore attribute (restore=all) is exposed to the internet via CrossAccountTrust to external Account.
Neptune cluster snapshot is publicly restorable (restore attribute contains 'all') via neptune:DescribeDBClusterSnapshotAttributes, establishing a CrossAccountTrust.
Domain access policy grants es:ESHttp* to a principal in a foreign AWS account, enabling cross-account data access without a role assumption.
quicksight:RegisterUser + quicksight:UpdateUser (role=ADMIN) lets an attacker promote themselves or others to QuickSight admin, gaining read access to all datasets, dashboards, and data source configurations.
An attacker who can modify QuickSight's configuration (UpdateAccountSettings) and pass an IAM role to it gains execution as that role for all data queries.
A shared subnet collapses the inter-account network boundary: consumer workloads launched into the shared subnet are on-link with owner-account resources, yielding on-subnet network reachability.
A shared Transit Gateway enables the consumer VPC to reach owner-account resources attached to the TGW, derived from the CrossAccountTrust fact and confirmed TGW attachments.
redshift:AuthorizeDataShare grants a consumer AWS account real-time read access to producer cluster objects, establishing cross-account live data trust.
redshift-serverless:PutResourcePolicy allows a principal to grant another AWS account live access to a Redshift Serverless namespace via resource policy.
A principal in account B provisioning a product from a portfolio shared by account A (servicecatalog:ProvisionProduct) causes resources to be deployed in account A as the account-A launch role. The receiving-account principal effectively gains a foothold in account A via the launch role's permissions.
Cross-account read of a secret that is credentials for a local identity is a foothold in this account.
A queue resource policy granting sqs:SendMessage to a principal in another account is cross-account publish trust; fed by messaging-chains rule 4 to derive CanEnterAccount.
A principal in account A that can execute commands on an instance in account B, which runs as a role in account B, gains a foothold in account B.