Derivation rules

An EMR cluster whose instance profile has s3:PutObject on an attacker-controlled S3 bucket can exfiltrate data via Spark df.write or Hive INSERT OVERWRITE DIRECTORY.

Every EC2 node in an EMR cluster exposes the instance profile (JobFlowRole) credentials via the EC2 Instance Metadata Service (IMDS); any code running on the cluster can retrieve them.

Every EC2 node in an EMR cluster exposes the instance profile (JobFlowRole) credentials via the EC2 Instance Metadata Service (IMDS); any code running on the cluster can retrieve them.

Submit an EMR on EKS job run with attacker-controlled application code and a passed privileged execution role via emr-containers:StartJobRun + iam:PassRole.

An EMR on EKS job run executes as the IAM role bound to the virtual cluster's job execution binding (IRSA).

iam:PassRole for the EMR on EKS job execution role, required by emrcontainers:StartJobRun.

emr-containers:StartJobRun lets a principal submit a Spark/Hive job with attacker-controlled application code on an EKS-hosted EMR virtual cluster.

iam:PassRole for the EMR instance profile / JobFlowRole, required by RunJobFlow.

iam:PassRole for the EMR ServiceRole (elasticmapreduce.amazonaws.com), required by RunJobFlow.

elasticmapreduce:RunJobFlow lets a principal create a new cluster with attacker-chosen bootstrap actions, AMI, and steps.

Submit an EMR Serverless job run with attacker-controlled application code and a passed privileged executionRole via emr-serverless:StartJobRun + iam:PassRole.

An EMR Serverless job run executes as the executionRoleArn provided at StartJobRun.

iam:PassRole for the EMR Serverless executionRoleArn, required by StartJobRun.

emr-serverless:StartJobRun lets a principal submit a Spark/Hive job with attacker-controlled application code.

EMR step arguments (jar args, script args) may contain hardcoded DB passwords, access keys, or connection strings visible via DescribeStep.

Write to EMR Studio workspace S3 backing to inject code into notebooks; notebook execution runs as Studio service role or attached cluster's JobFlowRole.

S3 URI backing EMR Studio workspace (DefaultS3Location); used to detect notebook-injection attack surface.

PassRole + ability to create/run a compute resource that accepts the role.

A principal with fms:DeleteNotificationChannel can permanently remove the SNS topic that receives FMS compliance notifications, creating an irreversible silent-running state for FMS enforcement.

A principal with fms:DeletePolicy can permanently delete an existing Firewall Manager policy, eliminating org-wide enforcement of WAF/Shield/Security Group/ Network Firewall/DNS Firewall controls across all in-scope member accounts. This is an irreversible destructive action with maximum blast radius.

A principal with fms:PutPolicy can overwrite an existing Firewall Manager policy with an empty or permissive rule set, or set RemediationEnabled=false, disabling org-wide enforcement of WAF/Shield/Security Group/Network Firewall/ DNS Firewall controls across all in-scope member accounts - a high-blast-radius defense-evasion / cover-tracks primitive. The policy object persists; enforcement is weakened but not destroyed.

A principal with fms:PutNotificationChannel can replace the SNS topic that receives FMS compliance notifications, redirecting or suppressing alerts about policy violations. This silences detective coverage without removing enforcement.

An identity with fsx:CopyBackup on a source backup ARN in a foreign account can pull a complete copy into an attacker-controlled account; restoring via CreateFileSystemFromBackup gives full read of all data at backup time.

A backup's resource policy (via fsx:GetResourcePolicy) grants fsx:CopyBackup to a principal in a different AWS account, establishing a cross-account trust on the backup resource.

An identity with fsx:CreateDataRepositoryTask on an FSx for Lustre file system with a Data Repository Association (DRA) pointing to an attacker-accessible S3 bucket can trigger a data export from the Lustre FS to S3, exfiltrating all file data.

An identity with fsx:CreateVolumeFromBackup on an ONTAP volume backup (same account) can restore the volume to an ONTAP file system they control, achieving lateral movement and data access to the restored volume.

An identity with fsx:PutResourcePolicy on an FSx backup can rewrite the backup's resource policy to grant an external account fsx:CopyBackup access, staging a cross-account backup exfil without touching the live file system.

An identity with fsx:CreateFileSystemFromBackup on a same-account backup can restore the data to a new file system in a different VPC or AD domain, achieving lateral movement and data access within the same account.

Delete the GuardDuty detector, permanently eliminating threat detection in the account/region.

Disable the GuardDuty detector via UpdateDetector(Enable=false), pausing all finding generation.

Sever a member account's GuardDuty aggregation link to the Organizations delegated administrator, creating a central-monitoring blind spot.

Principal holds effective IAM permission to create GuardDuty filters.

Principal holds effective IAM permission to create GuardDuty trusted-IP sets.

Principal holds effective IAM permission to delete GuardDuty detector.

Principal holds effective IAM permission to disassociate from GuardDuty delegated administrator (member account action).

Principal holds effective IAM permission to disassociate member accounts from GuardDuty (admin account action).

Principal holds effective IAM permission to retrieve GuardDuty findings details.

Principal holds effective IAM permission to list GuardDuty findings.

Principal holds effective IAM permission to update GuardDuty detector (including Enable=false).

Principal holds effective IAM permission to update GuardDuty filters.

Principal holds effective IAM permission to update GuardDuty findings feedback (mark as FALSE_POSITIVE).

Principal holds effective IAM permission to update GuardDuty trusted-IP sets.

Principal holds effective IAM permission to update GuardDuty publishing destination.

Read GuardDuty findings to enumerate detected threats - useful for an attacker to confirm whether their activity was detected.

Create or update a GuardDuty filter to auto-archive (suppress) specific findings, enabling stealthy evasion while the detector appears operational.

Add attacker-controlled IPs to a GuardDuty trusted-IP set (IPSet), suppressing network-based findings for those addresses.

Mark GuardDuty findings as FALSE_POSITIVE to bypass SOAR automation, poison the ML model, and reduce SOC visibility.

Redirect GuardDuty findings export to an attacker-controlled S3 bucket, exfiltrating security telemetry and severing central SOC visibility.

A DEPLOYED Global Accelerator with anycast IPs enabled is internet-reachable. This rule derives the exposure fact from the normalizer's structural Accelerator node.

A principal with globalaccelerator:UpdateEndpointGroup or globalaccelerator:AddEndpoints can redirect internet-bound anycast traffic to a different or attacker-influenced endpoint within the account (traffic hijack / defense evasion).