Derivation rules

2,433 declarative match → where → emit rules (1,787 derived, 646 explicit). Filter by cloud, emitted edge, node type, or text.

2,433 rule(s) · page 14 of 49

Principal with rds:ModifyDBClusterSnapshotAttribute permission on a Neptune cluster snapshot can share it cross-account or make it publicly restorable, enabling full graph data exfiltration.
aws CanExfiltrate derived
Neptune cluster snapshot with public restore attribute (restore=all) is exposed to the internet via CrossAccountTrust to external Account.
aws ExposedToInternet derived
Neptune cluster snapshot is publicly restorable (restore attribute contains 'all') via neptune:DescribeDBClusterSnapshotAttributes, establishing a CrossAccountTrust.
aws CrossAccountTrust explicit
Principal with neptune-db:connect and neptune-db:GetStreamRecords on the cluster resource ARN can read all graph mutations via Neptune Streams.
aws CanReadData derived
Disable or modify the firewall's logging configuration, removing evidence of network traffic inspection, rule violations, and IPS alerts (cover tracks).
Swap the policy associated with a firewall to a permissive alternative, weakening or eliminating VPC traffic filtering (defense evasion).
Modify the firewall policy directly (change default action to PASS, remove blocking rule groups), weakening or eliminating VPC traffic filtering (defense evasion).
Modify or delete a customer-managed Network Firewall rule group to remove or corrupt 5-tuple/Suricata DROP/REJECT rules, opening traffic paths across all firewall policies that reference the group (defense evasion; blast radius scales with rule group reuse and RAM sharing).
Domain access policy grants es:ESHttp* to a principal in a foreign AWS account, enabling cross-account data access without a role assumption.
aws CrossAccountTrust derived
A foreign-account principal allowed by the domain access policy reads OpenSearch data cross-account.
aws CanReadData derived
Principal with es:ESHttpDelete on the domain can delete documents and indices (destructive impact, not escalation).
aws CanDeleteData derived
A principal with data-plane read access to an internet-exposed or reachable OpenSearch domain can exfiltrate search indices.
aws CanExfiltrate derived
A principal with es:UpdateDomainConfig on a FGAC-enabled domain can disable FGAC and grant all IAM-permitted principals cluster-admin data access.
aws CanEscalateTo derived
A principal with es:UpdateDomainConfig on a FGAC domain with internal user database can reset and effectively read the master-user password.
aws CanReadSecret derived
FGAC domain with internal user database exposes the master-user password to whoever can call es:UpdateDomainConfig.
aws ExposesCredential derived
OpenSearch domain with a public endpoint and Principal:* access policy is reachable from the internet; unauthenticated if FGAC is also disabled.
aws ExposedToInternet derived
Principal with es:ESHttpGet / es:ESHttpHead on the domain reads indexed data via the OpenSearch REST API.
aws CanReadData derived
Principal with es:ESHttpPost / es:ESHttpPut on the domain can index or update documents via the OpenSearch REST API.
aws CanWriteData derived
opsworks:SetPermission grants a principal the ability to assign deploy/admin/SSH rights to any OpsWorks user on a stack.
aws CanGrantPermission explicit
opsworks:CreateDeployment grants ability to run arbitrary Chef recipes or commands on stack instances (execute_recipes / run_command).
aws CanModifyCode explicit
opsworks:UpdateApp lets a principal change an app's source repository, enabling application supply-chain injection.
aws CanModifyCode explicit
opsworks:UpdateStack lets a principal change the custom cookbook source URL, enabling cookbook supply-chain injection.
aws CanModifyCode explicit
opsworks:UpdateStack + iam:PassRole on the new service role swaps the identity OpsWorks operates as.
aws CanModifyTrust explicit
opsworks:CreateDeployment can trigger a deployment run using the stack's current cookbook/app definition.
aws CanTrigger explicit
opsworks:CloneStack + iam:PassRole on a privileged role lets a principal create a cloned stack running as that role.
aws CanPassIdentity explicit
OpsWorks App secure environment variables are credentials accessible to all deployment code on the stack.
aws ContainsSecret explicit
opsworks:CreateDeployment lets a principal run arbitrary Chef recipes or commands on stack instances as the instance profile role.
aws CanModifyCode derived
opsworks:CreateDeployment (non-execute_recipes flavors) triggers a deployment with the stack's current cookbook definition - CanTrigger into the instance for cicd-chains rule 2.
aws CanTrigger derived
OpsWorks-managed EC2 instance runs as its IAM instance profile role.
aws ExecutesAs explicit
OpsWorks Stack's control plane operates as the stack's service role.
aws ExecutesAs explicit
An OpsWorks-managed EC2 instance exposes its instance profile role credentials to any code that runs on it (via IMDS).
aws ExposesCredential derived
iam:PassRole for opsworks.amazonaws.com (service role) or ec2.amazonaws.com (instance profile) plus opsworks:CreateStack or opsworks:UpdateStack lets a principal bind a chosen role to a stack.
aws CanPassIdentity explicit
opsworks:DescribeStackProvisioningParameters exposes agent registration keys and other provisioning secrets.
aws CanReadSecret explicit
opsworks:SetPermission lets a principal grant any OpsWorks user admin or deploy rights on a stack, enabling self-escalation to deployment capability.
aws CanGrantPermission derived
opsworks:UpdateStack can redirect the custom cookbook source to an attacker-controlled repo, making all future cookbook deployments run attacker code as the instance profile role.
aws CanModifyCode derived
opsworks:UpdateUserProfile overwrites an OpsWorks user's SSH public key; OpsWorks propagates it to all stack instances at the next configure event, giving SSH access.
aws CanExecuteCommand derived
qldb:ExportJournalToS3 + iam:PassRole (for a role with s3:PutObject) allows the caller to exfiltrate the entire QLDB journal - all committed document revisions across all tables - to an S3 bucket, including cross-account buckets.
aws CanExfiltrate derived
qldb:PartiQLSelect (plus qldb:SendCommand as session gate) on a STANDARD-mode ledger's table allows the caller to read all documents from that table, yielding data-plane read scoped to the individual table.
aws CanReadData derived
qldb:PartiQLHistoryFunction (plus qldb:SendCommand as session gate) on a STANDARD-mode ledger's table allows the caller to read all document revisions (full version history) from that table, yielding data-plane read scoped to the individual table with higher impact than current-state-only reads.
aws CanReadData derived
qldb:SendCommand on an ALLOW_ALL-mode ledger allows the caller to run arbitrary PartiQL SELECT statements against all tables, yielding full data-plane read of all committed document revisions.
aws CanReadData derived
qldb:StreamJournalToKinesis + iam:PassRole (for a role with kinesis:PutRecord) allows the caller to continuously stream the entire QLDB journal - all committed document revisions across all tables - to a Kinesis Data Stream, including cross-account streams.
aws CanExfiltrate derived
quicksight:RegisterUser + quicksight:UpdateUser (role=ADMIN) lets an attacker promote themselves or others to QuickSight admin, gaining read access to all datasets, dashboards, and data source configurations.
aws CanGrantPermission derived
move · open · esc close