Derivation rules

A management-account principal that can assume OrganizationAccountAccessRole enters the member account as full admin.

A stack's service role (Identity) triggers the Custom:: resource Lambda during stack lifecycle events via lambda:InvokeFunction; principals who CanExecuteAs the service role inherit this CanTrigger path.

cloudformation:CreateStackInstances / UpdateStackSet in the admin account deploys to target accounts, executing as the StackSet execution role there - a cross-account foothold.

CodeDeploy lifecycle hook scripts (running as root on EC2/on-prem targets) can read the instance profile role credentials from IMDS, exposing them to the attacker's code.

Trigger a deployment to execute orchestration-plane actions as the deployment group's service role - requires a run path.

A Cognito-authenticated federated identity presents a valid pool token to receive temporary IAM credentials for the authenticated role. When the role trust condition is broad (authenticated but any provider), any authenticated pool user - regardless of the provider used - receives the role.

An IAM principal with cognito-identity:GetOpenIdTokenForDeveloperIdentity can synthesize a developer-authenticated token for any developerUserId in the pool and exchange it for the authenticated role's IAM credentials, bypassing user authentication entirely.

An Identity Pool role mapping rule selects a privileged IAM role based on a token claim value the pool user can write (e.g. a custom User Pool attribute updatable via UpdateUserAttributes), enabling self-escalation to the mapped role.

An Identity Pool with AllowUnauthenticatedIdentities=true lets any internet user call GetId + GetCredentialsForIdentity (no credentials required) to receive temporary IAM credentials for the unauthenticated role.

config:PutRemediationConfigurations + iam:PassRole sets the AutomationAssumeRole on a Config remediation configuration; when triggered, Config invokes SSM Automation as that role, yielding code execution as the passed role.

A management-account principal that can assume AWSControlTowerExecution enters every enrolled member account as administrator.

The Data Pipeline service assumes the pipeline's `role` field to provision compute resources and access downstream AWS services on the pipeline's behalf.

A pipeline's EC2 or EMR resource node executes as the IAM role in the pipeline's resourceRole field, making that role reachable via IMDS by any code the pipeline runs.

A pipeline's EC2 or EMR resource node exposes the resourceRole's temporary credentials to any code running in its activities via the IMDS endpoint.

iam:PassRole on a role that trusts datapipeline.amazonaws.com lets the principal bind it as the pipeline role, used by the Data Pipeline service to provision EC2/EMR resources and access downstream AWS services.

iam:PassRole on a role that trusts ec2.amazonaws.com lets the principal bind it as the resourceRole in a Data Pipeline definition, enabling code running on the EC2/EMR node to execute as that role.

Explicit extraction: the Data Pipeline service assumes the role specified in the role field.

Explicit extraction: a pipeline's EC2 or EMR resource node runs as the IAM role specified in the resourceRole field.

An EventBridge rule assumes its invocation RoleArn (via events.amazonaws.com) to call targets that require IAM authorization; code running as that rule effectively runs as the invocation role.

An EventBridge Scheduler schedule assumes its Target.RoleArn (via scheduler.amazonaws.com) at each fire; anyone who can modify the schedule or the role effectively runs as that role on a cadence.

An IAM role whose trust policy Federated principal matches an EKS cluster OIDC issuer URL trusts that cluster's projected SA tokens.

A Kubernetes ServiceAccount annotated with eks.amazonaws.com/role-arn and a matching IAM role trust policy (Federated = cluster OIDC issuer) lets any pod running as that KSA exchange its projected token for IAM role credentials via sts:AssumeRoleWithWebIdentity. Cites container-chains workload-identity-federates and federation-chains federation-maps-to-identity.

Pods on EC2 managed nodes with IMDS hop-limit >= 2 can reach 169.254.169.254 and retrieve temporary credentials for the node group IAM role. Any code execution inside such a pod inherits the node role without any IRSA or Pod Identity annotation.

Exec into a running pod (via cluster-admin or direct pods/exec RBAC) inherits the pod's mounted IRSA or Pod Identity token, executing as the pod's IAM role. Cites container-chains cluster-rbac-exec; dedupes on (CanExecuteAs, principal, role).

An EKS Pod Identity Association (eks:CreatePodIdentityAssociation) links a Kubernetes namespace:ServiceAccount pair to an IAM role. Pods running as that SA receive IAM credentials from the eks-pod-identity-agent at 169.254.170.23. Whoever can create or modify this association can reroute which IAM role any pod in that namespace:SA binding runs as.

An IAM role whose trust policy Service principal includes pods.eks.amazonaws.com is eligible for EKS Pod Identity associations.

A Kubernetes RBAC subject (user/group/SA) holding pods/exec create verb on a namespace can exec into any pod in that namespace.

Signing with a key that anchors an auth system forges the trusted identity.

A Lightsail instance with an associated IAM role exposes that role's session via IMDS.

opsworks:UpdateStack + iam:PassRole on the new service role swaps the identity OpsWorks operates as.

opsworks:CloneStack + iam:PassRole on a privileged role lets a principal create a cloned stack running as that role.

iam:PassRole for opsworks.amazonaws.com (service role) or ec2.amazonaws.com (instance profile) plus opsworks:CreateStack or opsworks:UpdateStack lets a principal bind a chosen role to a stack.

quicksight:RegisterUser + quicksight:UpdateUser (role=ADMIN) lets an attacker promote themselves or others to QuickSight admin, gaining read access to all datasets, dashboards, and data source configurations.

quicksight:UpdateAccountSettings + iam:PassRole (to quicksight.amazonaws.com) lets an attacker swap the QuickSight service role.

Creating/updating a Roles Anywhere profile that lists a privileged role (with iam:PassRole) maps the attacker's cert to that role.

Registering an attacker-controlled CA as a trust anchor lets the attacker mint certs that federate into any role trusting the Roles Anywhere service principal.

A cert holder whose subject satisfies a Roles Anywhere role trust can CreateSession to obtain that role's temporary credentials.

Create a new State Manager association with a privileged role and attacker-controlled document parameters, yielding recurring scheduled code execution as that role.

Create a new Automation document with attacker-controlled steps and bind a passable privileged role, yielding code execution as that role.

A managed instance exposes its instance-profile role credentials to any code running on it via the IMDS endpoint.

Register a Run Command / Automation task with a Maintenance Window, binding a privileged service role that the task will run as.