Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
An active Endpoint Group with healthy endpoints forwards traffic from the accelerator to each endpoint. Emits CanNetworkReach CONDITIONAL on network reachability, per Phase 8 discipline for per-service network facts.
Change an existing Glue job's RoleArn to a passed privileged role via glue:UpdateJob + iam:PassRole; the next run executes as the new role.
The Glue Data Catalog resource policy names a principal in another AWS account, granting cross-account metadata (and optionally data) access.
A Glue Connection stores JDBC/Kafka/OAuth credentials; glue:GetConnection returns the plaintext PASSWORD, exposing the database credential.
Create an interactive Glue Session bound to a passable role, then execute code inline via RunStatement to run as that role.
Create a new Glue job bound to a passable privileged IAM role, then run it, to execute as that role.
Inject an SSH public key into a running Glue development endpoint via glue:UpdateDevEndpoint, gaining OS-level command execution on the Spark cluster host.
Overwrite the S3 object that a Glue job's ScriptLocation references (s3:PutObject), poisoning the ETL code; the next run executes as the job's IAM role.
Update a Glue job's ScriptLocation to an attacker-controlled S3 object, establishing the code-modify and trigger facts needed for can-execute-as derivation.
A Glue job's DefaultArguments or StartJobRun Arguments contain embedded credentials (connection strings, API keys, tokens) that are exposed via glue:GetJob or glue:GetJobRun.
Modify an Image Builder container recipe (or the pipeline referencing it) and trigger a build to push a poisoned container image to the target ECR repository, feeding the container-chains supply-chain fan-out to all downstream consumers.
Create a new image pipeline with an infrastructure configuration that uses a passable IAM role as its instance profile, then trigger a build to execute as that role.
Create a new malicious component version, update the pipeline to reference it, and trigger a build to execute shell commands as the build instance's IAM role.
Overwrite a component's S3-backed document (s3:PutObject on the component URI bucket/key) to inject malicious steps that execute on the next build as the build instance role.
Replace the infrastructure configuration's instance profile with a higher-privilege IAM role (UpdateInfrastructureConfiguration + iam:PassRole), then trigger a build to execute as that role.
Trigger an Image Builder pipeline whose current definition already executes attacker-influenced code (e.g., an S3-overwritable component URI or an already-tampered component version), executing as the build instance role.
Update an image pipeline to reference an attacker-controlled recipe (which may include malicious components or an S3-overwritable component URI), then trigger a build to execute as the build instance role.
Delegated-administrator account principal with inspector2:Disable can disable scanning for any/all organization member accounts simultaneously, stopping CVE detection across the entire AWS Organization from a single API call.
Principal with inspector2:Disable can stop vulnerability scanning in the account (or designated member accounts from delegated-admin), removing continuous CVE and network-exposure detection - a defense-evasion primitive.
Principal with inspector2:UpdateConfiguration can modify scan settings (e.g., Lambda deep scan, ECR scanning toggle), affecting detection depth but not service enablement.
cassandra:Alter on a source table to enable PITR, then cassandra:Restore + cassandra:Create + cassandra:Select on the target keyspace permits PITR exfiltration even when PITR is initially disabled. This is a two-step escalation path (POTENTIAL state).
IAM-effective cassandra:Modify on a Keyspaces table allows CQL INSERT, UPDATE, and DELETE, enabling data tampering and injection attacks.
cassandra:Restore on a source table + cassandra:Create + cassandra:Select on the target keyspace permits PITR-based table copy exfiltration: attacker restores source table data to a new table they control and can read via cassandra:Select.
IAM-effective cassandra:Select on a Keyspaces table allows full data-plane read (CQL SELECT), yielding all row data including any secret material.
A Kinesis stream resource policy granting kinesis:PutRecord(s) to a principal in another account is cross-account publish trust, enabling that external principal to trigger the stream's Lambda consumer.
A Kinesis stream resource policy granting read actions (GetRecords/GetShardIterator/SubscribeToShard) to a foreign account enables that account to read the stream's records, supporting data exfiltration.
kinesis:PutResourcePolicy on a stream grants the ability to rewrite the stream's resource policy, enabling privilege escalation via grant injection or cross-account access expansion.
kinesis:PutRecord(s) to a stream with an active Lambda ESM triggers the consumer function with an attacker-influenced record payload.
kinesis:GetRecords + kinesis:GetShardIterator lets a principal read raw records from the stream, enabling data exfiltration or credential harvest if records carry sensitive content.
kinesis:RegisterStreamConsumer + kinesis:SubscribeToShard enables reading from a stream via the enhanced fan-out path (push-based), equivalent to GetRecords-based polling.
Cross-account decrypt that unlocks THIS account's credentials is an account foothold.
An external principal permitted by the key policy/grant can use the key cross-account.
A KMS-decryptable secret exposes the credential of the identity it belongs to once the KMS gate is satisfied.
Decrypt on the CMK protecting a store completes the key_permission gate for data reads.
Decrypt on a CMK completes the key_permission gate for a secret encrypted under it.
GenerateDataKey* returns a usable plaintext data key -> envelope decryption of ciphertext under the key.
Admin of a key (PutKeyPolicy/CreateGrant) can self-grant kms:Decrypt then use it.
ReEncryptFrom proves KMS can decrypt the source ciphertext; with an attacker-decryptable destination key, data is recoverable.
Decrypting a KMS-encrypted secret whose credential is a more-privileged identity is privilege escalation.
Forging a signature for a more-privileged identity is privilege escalation.
Keys with imported material (Origin: EXTERNAL) may be controllable offline by the importer.