Derivation rules

route53:ChangeResourceRecordSets on a public hosted zone enables DNS record mutation - traffic redirection, MX/SPF override, and subdomain NS delegation (DNS hijacking primitive).

route53:ChangeResourceRecordSets on a private hosted zone enables internal DNS hijacking within associated VPCs - traffic redirection for VPC-resident workloads only.

A dangling alias or CNAME record pointing to a deprovisioned AWS resource enables subdomain takeover - an attacker (unauthenticated, from the internet) claims the deprovisioned resource and serves content on the hijacked name without any AWS IAM permission required.

route53:ChangeResourceRecordSets enables adding NS records for a subdomain, delegating full authority for that subtree to an attacker-controlled nameserver (broader than a single A-record redirect).

route53:CreateHostedZone with --vpc or route53:AssociateVPCWithHostedZone enables creating a shadow private zone or extending an existing zone's resolution scope across VPCs - DNS MITM for all workloads in the associated VPC.

route53domains:UpdateDomainNameservers replaces the authoritative NS servers at the domain registry - full domain takeover, redirecting ALL DNS resolution for the domain to attacker-controlled infrastructure.

route53domains:TransferDomainToAnotherAwsAccount transfers domain registration ownership to another AWS account - complete loss of domain registration control, enabling the attacker to modify registrar settings and potentially lock out the legitimate owner.

s3:CreateJob + iam:PassRole for a privileged IAM role creates an S3 Batch Operations job that runs as that role - a CanCreateWorkloadAs pattern for S3 Batch.

s3:PutBucketPublicAccessBlock + s3:PutBucketPolicy enables a two-step escalation to expose the bucket - attacker CAN expose the bucket but it is NOT currently exposed.

s3:ListBucket + s3:GetObject on a bucket enables enumeration and download of all objects - a complete bucket exfiltration.

s3:PutReplicationConfiguration sets up continuous S3 Replication to an external/attacker-controlled destination bucket, establishing a persistent data exfiltration channel.

s3:PutBucketNotification lets a principal reconfigure event notification targets (Lambda/SQS/SNS/EventBridge) for a bucket, redirecting all S3 events to attacker-controlled destinations.

s3:PutObject on a bucket that is a verified code-artifact deployment source (Lambda, CodePipeline, CloudFormation) for a compute workload equals modifying that workload's code.

s3:PutBucketPolicy lets a principal rewrite the bucket policy in full, self-granting any S3 permission including making the bucket public.

S3 bucket with a Principal:* bucket policy allowing s3:GetObject and Block Public Access disabled (RestrictPublicBuckets=false) is readable by any internet client.

s3:PutBucketAcl on a bucket with ObjectOwnership != BucketOwnerEnforced and Block Public Access IgnorePublicAcls=false enables ACL-based public exposure.

A principal that can read a bucket's data (CanReadData) and the bucket contains secrets (ContainsSecret) can read those secrets via s3:GetObject.

s3:GetObject on a bucket grants full data-plane read of stored objects (SSE-S3/no-encryption path - AWS-managed decryption, no caller kms:Decrypt needed).

s3:GetObject on a SSE-KMS bucket: read is CONDITIONAL on kms:Decrypt for the wrapping CMK. Cite credential-chains:decrypt-gates-secret-read to upgrade to ACTIVE.

S3 static website hosting publishes a public HTTP endpoint serving bucket objects, independent of the bucket policy's API access controls.

s3:PutObject on a bucket grants data-plane write, enabling object creation/overwrite - including code artifact poisoning.

Create a new SageMaker compute resource (training/processing job, notebook, pipeline) bound to a passed privileged role - the canonical SageMaker PassRole privesc pattern.

An MLflow Tracking Server executes as its RoleArn.

A SageMaker Model executes as its ExecutionRoleArn at serving (endpoint) and batch-transform time.

A SageMaker notebook instance executes kernel code as its RoleArn (execution role).

A SageMaker Pipeline execution runs steps as its RoleArn.

A SageMaker processing job container executes as its RoleArn.

A SageMaker Studio App (JupyterServer/KernelGateway) executes as the UserProfile's ExecutionRole.

A SageMaker training job container executes as its RoleArn.

SageMaker compute surfaces (notebook/training/processing job/pipeline/Studio app) expose execution-role credentials to all code running inside them via IMDS or the container credentials endpoint.

GetRecord / BatchGetRecord reads ML feature data from a SageMaker Feature Store online store.

StartPipelineExecution directly invokes a SageMaker Pipeline, running its steps as the pipeline's execution role.

iam:PassRole to sagemaker.amazonaws.com for model creation, binding a role to be used at serving/transform time.

iam:PassRole to sagemaker.amazonaws.com for notebook instance creation.

iam:PassRole to sagemaker.amazonaws.com for pipeline creation, giving attacker-controlled pipeline steps the passed role's credentials.

iam:PassRole to sagemaker.amazonaws.com for training/processing/hyperparameter-tuning/compilation job creation.

iam:PassRole to sagemaker.amazonaws.com for MLflow tracking server role updates.

CreatePresignedDomainUrl opens a Studio session as the specified user profile's execution role - no iam:PassRole required.

CreatePresignedNotebookInstanceUrl opens a browser-based Jupyter shell on a running notebook, giving the caller immediate code execution as the notebook's execution role - no iam:PassRole required.

UpdateDomain changes the default execution role for all new Studio apps in the domain.

UpdateNotebookInstance changes notebook configuration including RoleArn (with PassRole), instance type, subnet, and security groups.

UpdateNotebookInstance changing the lifecycle config injects a shell script that runs as root on next start, within the notebook's execution role context.

UpdatePipeline can also change the pipeline's RoleArn (with PassRole), swapping the execution identity for all future pipeline executions.

UpdatePipeline replacing the pipeline definition injects attacker-controlled step code that runs as the pipeline's execution role.

UpdateUserProfile changes the execution role for a specific Studio user profile.

servicecatalog:CreateProvisioningArtifact adds a new product version carrying an attacker-controlled CFN template. The next ProvisionProduct or UpdateProvisionedProduct using that version executes the attacker's template as the launch role bound to the product. cicd-chains propagates this CanModifyCode + ExecutesAs into CanExecuteAs.

servicecatalog:CreateConstraint + iam:PassRole(servicecatalog.amazonaws.com): add a LaunchRole constraint to a product in a portfolio, binding a chosen privileged role. All subsequent ProvisionProduct calls then execute as that launch role. can-execute-as execute-as-via-config-identity-swap propagates with CanPassIdentity to derive CanExecuteAs.

A principal in account B provisioning a product from a portfolio shared by account A (servicecatalog:ProvisionProduct) causes resources to be deployed in account A as the account-A launch role. The receiving-account principal effectively gains a foothold in account A via the launch role's permissions.

servicecatalog:ProvisionProduct or UpdateProvisionedProduct on a product bound to a LaunchRole constraint executes the product's CFN template as the launch role, even when the provisioning principal holds no CloudFormation or IAM permissions of their own. Any parameter-driven custom resource or UserData the user controls runs as the launch role.