Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
An attacker who can modify QuickSight's configuration (UpdateAccountSettings) and pass an IAM role to it gains execution as that role for all data queries.
A QuickSight data source that stores database credentials (CredentialPair / API key) exposes those credentials - readable by the QuickSight service and potentially exfiltrable by updating the data source endpoint.
quicksight:UpdateAccountSettings + iam:PassRole (to quicksight.amazonaws.com) lets an attacker swap the QuickSight service role.
quicksight:CreateDataSource (relational types) with an attacker-controlled endpoint causes QuickSight to transmit credentials to that host on connection test/ingestion - SSRF-style credential exfiltration.
quicksight:UpdateDataSource on a data source with stored credentials lets an attacker overwrite those credentials or change the endpoint, triggering credential exfiltration or database takeover.
A RAM share whose principal is the organization root (o-*) exposes the shared resource to every current and future member account in the organization - ExposedToTenant.
A shared subnet collapses the inter-account network boundary: consumer workloads launched into the shared subnet are on-link with owner-account resources, yielding on-subnet network reachability.
A shared Transit Gateway enables the consumer VPC to reach owner-account resources attached to the TGW, derived from the CrossAccountTrust fact and confirmed TGW attachments.
rds-data:ExecuteStatement on an Aurora cluster (Serverless v1/v2 or provisioned with HttpEndpointEnabled) allows IAM-authenticated SQL execution via the RDS Data API - no DB client, VPC foothold, or static password required.
rds-db:connect on a DB user ARN grants IAM database authentication - the principal can generate a 15-minute token to connect as the mapped DB user without a static password.
Reading the RDS-managed master password secret (secretsmanager:GetSecretValue on MasterUserSecretArn) yields superuser DB access - the master credential authenticates as the DB admin user.
rds:ModifyDBInstance or rds:ModifyDBCluster with MasterUserPassword resets the master DB password to an attacker-known value, granting superuser DB access without knowing the current password.
rds:RestoreDBInstanceFromDBSnapshot or rds:RestoreDBClusterFromSnapshot with a shared or public snapshot allows a principal to restore a full database copy as the master user - gaining superuser access to all data.
rds:ModifyDBSnapshotAttribute(AttributeName=restore, ValuesToAdd=[all]) makes a DB snapshot publicly restorable by any AWS account - full database exfiltration with no network access required.
A principal with secretsmanager:GetSecretValue on the Redshift ManagedAdminPassword secret can retrieve the plaintext admin DB password and connect as superuser, reading all warehouse data.
redshift:AuthorizeDataShare grants a consumer AWS account real-time read access to producer cluster objects, establishing cross-account live data trust.
Create a new Redshift cluster (or Serverless namespace) with an attacker-chosen IAM role attached, then run queries as that role.
Pass a privileged IAM role to a Redshift cluster (iam:PassRole + ModifyClusterIamRoles), then submit a COPY/UNLOAD/UDF query that uses that role's AWS permissions. Covers both already-attached and attach-new-then-execute paths.
A principal with query execution on a Redshift cluster can run UNLOAD using an attached IAM role that has s3:PutObject, exfiltrating warehouse data to an S3 location.
redshift:GetClusterCredentials generates a temporary database username/password, enabling JDBC/ODBC authentication to the cluster as the requested DB user.
A Redshift cluster or Serverless workgroup with PubliclyAccessible=true and a permissive VPC security group is reachable from the public internet on port 5439.
redshift-data:ExecuteStatement lets a principal run SELECT queries against the cluster via the Data API, reading tables accessible to the IAM-mapped DB user.
redshift-serverless:PutResourcePolicy allows a principal to grant another AWS account live access to a Redshift Serverless namespace via resource policy.
redshift-serverless:UpdateSnapshot allows sharing a Redshift Serverless snapshot with another AWS account, enabling full data exfiltration via restore.
redshift:AuthorizeSnapshotAccess grants another AWS account the ability to restore a cluster snapshot, exfiltrating a full copy of warehouse data to that account.
Creating/updating a Roles Anywhere profile that lists a privileged role (with iam:PassRole) maps the attacker's cert to that role.
Registering an attacker-controlled CA as a trust anchor lets the attacker mint certs that federate into any role trusting the Roles Anywhere service principal.
A cert holder whose subject satisfies a Roles Anywhere role trust can CreateSession to obtain that role's temporary credentials.