Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
Principal with rds:ModifyDBClusterSnapshotAttribute permission on a Neptune cluster snapshot can share it cross-account or make it publicly restorable, enabling full graph data exfiltration.
Neptune cluster snapshot with public restore attribute (restore=all) is exposed to the internet via CrossAccountTrust to external Account.
Neptune cluster snapshot is publicly restorable (restore attribute contains 'all') via neptune:DescribeDBClusterSnapshotAttributes, establishing a CrossAccountTrust.
Principal with neptune-db:connect and neptune-db:GetStreamRecords on the cluster resource ARN can read all graph mutations via Neptune Streams.
Disable or modify the firewall's logging configuration, removing evidence of network traffic inspection, rule violations, and IPS alerts (cover tracks).
Swap the policy associated with a firewall to a permissive alternative, weakening or eliminating VPC traffic filtering (defense evasion).
Modify the firewall policy directly (change default action to PASS, remove blocking rule groups), weakening or eliminating VPC traffic filtering (defense evasion).
Modify or delete a customer-managed Network Firewall rule group to remove or corrupt 5-tuple/Suricata DROP/REJECT rules, opening traffic paths across all firewall policies that reference the group (defense evasion; blast radius scales with rule group reuse and RAM sharing).
Domain access policy grants es:ESHttp* to a principal in a foreign AWS account, enabling cross-account data access without a role assumption.
A foreign-account principal allowed by the domain access policy reads OpenSearch data cross-account.
Principal with es:ESHttpDelete on the domain can delete documents and indices (destructive impact, not escalation).
A principal with data-plane read access to an internet-exposed or reachable OpenSearch domain can exfiltrate search indices.
A principal with es:UpdateDomainConfig on a FGAC-enabled domain can disable FGAC and grant all IAM-permitted principals cluster-admin data access.
A principal with es:UpdateDomainConfig on a FGAC domain with internal user database can reset and effectively read the master-user password.
FGAC domain with internal user database exposes the master-user password to whoever can call es:UpdateDomainConfig.
OpenSearch domain with a public endpoint and Principal:* access policy is reachable from the internet; unauthenticated if FGAC is also disabled.
Principal with es:ESHttpGet / es:ESHttpHead on the domain reads indexed data via the OpenSearch REST API.
Principal with es:ESHttpPost / es:ESHttpPut on the domain can index or update documents via the OpenSearch REST API.
opsworks:SetPermission grants a principal the ability to assign deploy/admin/SSH rights to any OpsWorks user on a stack.
opsworks:CreateDeployment grants ability to run arbitrary Chef recipes or commands on stack instances (execute_recipes / run_command).
opsworks:UpdateApp lets a principal change an app's source repository, enabling application supply-chain injection.
opsworks:UpdateStack lets a principal change the custom cookbook source URL, enabling cookbook supply-chain injection.
opsworks:UpdateStack + iam:PassRole on the new service role swaps the identity OpsWorks operates as.
opsworks:CreateDeployment can trigger a deployment run using the stack's current cookbook/app definition.
opsworks:CloneStack + iam:PassRole on a privileged role lets a principal create a cloned stack running as that role.
OpsWorks App secure environment variables are credentials accessible to all deployment code on the stack.
opsworks:CreateDeployment lets a principal run arbitrary Chef recipes or commands on stack instances as the instance profile role.
opsworks:CreateDeployment (non-execute_recipes flavors) triggers a deployment with the stack's current cookbook definition - CanTrigger into the instance for cicd-chains rule 2.
OpsWorks-managed EC2 instance runs as its IAM instance profile role.
OpsWorks Stack's control plane operates as the stack's service role.
An OpsWorks-managed EC2 instance exposes its instance profile role credentials to any code that runs on it (via IMDS).
iam:PassRole for opsworks.amazonaws.com (service role) or ec2.amazonaws.com (instance profile) plus opsworks:CreateStack or opsworks:UpdateStack lets a principal bind a chosen role to a stack.
opsworks:DescribeStackProvisioningParameters exposes agent registration keys and other provisioning secrets.
opsworks:SetPermission lets a principal grant any OpsWorks user admin or deploy rights on a stack, enabling self-escalation to deployment capability.
opsworks:UpdateStack can redirect the custom cookbook source to an attacker-controlled repo, making all future cookbook deployments run attacker code as the instance profile role.
opsworks:UpdateUserProfile overwrites an OpsWorks user's SSH public key; OpsWorks propagates it to all stack instances at the next configure event, giving SSH access.
qldb:ExportJournalToS3 + iam:PassRole (for a role with s3:PutObject) allows the caller to exfiltrate the entire QLDB journal - all committed document revisions across all tables - to an S3 bucket, including cross-account buckets.
qldb:PartiQLSelect (plus qldb:SendCommand as session gate) on a STANDARD-mode ledger's table allows the caller to read all documents from that table, yielding data-plane read scoped to the individual table.
qldb:PartiQLHistoryFunction (plus qldb:SendCommand as session gate) on a STANDARD-mode ledger's table allows the caller to read all document revisions (full version history) from that table, yielding data-plane read scoped to the individual table with higher impact than current-state-only reads.
qldb:SendCommand on an ALLOW_ALL-mode ledger allows the caller to run arbitrary PartiQL SELECT statements against all tables, yielding full data-plane read of all committed document revisions.
qldb:StreamJournalToKinesis + iam:PassRole (for a role with kinesis:PutRecord) allows the caller to continuously stream the entire QLDB journal - all committed document revisions across all tables - to a Kinesis Data Stream, including cross-account streams.
quicksight:RegisterUser + quicksight:UpdateUser (role=ADMIN) lets an attacker promote themselves or others to QuickSight admin, gaining read access to all datasets, dashboards, and data source configurations.