Derivation rules

Write access to the S3 object backing a Service Catalog product version's template (LoadTemplateFromURL): the next ProvisionProduct or UpdateProvisionedProduct loads the attacker's template and executes it as the launch role. cicd-chains propagates this CanModifyCode + ExecutesAs into CanExecuteAs.

servicecatalog:ExecuteProvisionedProductServiceAction on an associated SSM Automation service action executes the automation document as the service action's automation role. A principal who can trigger a provisioned product and execute its service actions runs arbitrary SSM Automation as the automation role.

servicecatalog:UpdateConstraint + iam:PassRole(servicecatalog.amazonaws.com) on a LaunchRole constraint: replace the launch role bound to a product with a more privileged role. The next ProvisionProduct executes as the new launch role. can-execute-as execute-as-via-config-identity-swap propagates with CanPassIdentity to derive CanExecuteAs.

Gates the existing explicit CanReadSecret edge on kms:Decrypt (CONDITIONAL(key_permission)) when the secret is CMK-encrypted.

Reading a secret that is credentials for a strictly-more-privileged identity is escalation.

Cross-account read of a secret that is credentials for a local identity is a foothold in this account.

Gates the existing explicit cross-account CanReadSecret edge on the secret resource policy AND the CMK key policy.

Sets the existing explicit CanReadSecret edge to ACTIVE when the secret is wrapped by the AWS-managed key (transparent same-account decrypt).

PutResourcePolicy self-grants GetSecretValue on a secret that is credentials for a more-privileged identity - escalation.

PutSecretValue/UpdateSecret plants an attacker-controlled credential in the secret that any consumer refetches and trusts.

Principal can disable Security Hub security controls, compliance standards, or the entire service (securityhub:UpdateStandardsControl / securityhub:BatchDisableStandards / securityhub:DisableSecurityHub), permanently preventing Security Hub from generating findings for those checks or disabling all detection - a persistent defense-evasion action that does not grant resource access.

Principal can fully disable AWS Security Hub (securityhub:DisableSecurityHub), eliminating all detection from GuardDuty, Inspector, Macie, Config, and IAM Access Analyzer integrations - the highest-impact defense-evasion primitive that does not grant resource access.

Principal can enumerate Security Hub findings (securityhub:GetFindings), yielding a detailed inventory of every resource with a known vulnerability or misconfiguration - useful recon for target selection in lateral movement.

Principal can suppress Security Hub findings (securityhub:BatchUpdateFindings), setting workflow state to SUPPRESSED or RESOLVED to hide attacker activity from dashboards and automated response - a defense-evasion primitive that does not grant access to any resource.

A Step Functions activity task state embeds the current execution data context as the task payload returned by GetActivityTask; if upstream states processed sensitive data, the payload may contain secrets.

states:UpdateStateMachineAlias / states:CreateStateMachineAlias allows redirecting an alias to a different definition version without triggering visible definition-update alerts.

states:StartExecution or states:StartSyncExecution allows a principal to directly start a state machine execution with an attacker-supplied input payload.

states:StartSyncExecution allows a principal to directly start a synchronous execution of an Express state machine with an attacker-supplied input payload.

states:UpdateStateMachine allows replacing the ASL definition with arbitrary Task states that call AWS services as the execution role - equivalent to a buildspec rewrite.

states:UpdateStateMachine combined with iam:PassRole on a new role allows swapping the execution role to a different IAM identity on an existing state machine.

states:GetActivityTask returns the next queued task input from a Step Functions activity, exposing the execution data context to the poller - any IAM principal with this permission can dequeue tasks from the activity.

states:GetExecutionHistory returns the full event history of a Standard workflow execution including state input/output, which may contain sensitive data from the execution's data context.

Creating or updating an EventBridge rule that targets a Step Functions state machine is persistence: it fires on a schedule/event pattern, starting executions without further attacker action.

Creating an EventBridge Scheduler schedule that targets a Step Functions state machine is persistence: it fires on a cadence with an optional execution role, running the state machine without further attacker action.

Create a new Step Functions state machine bound to any role passable to states.amazonaws.com, then start an execution to run arbitrary Task states as that role.

A cross-account principal with states:StartExecution on a state machine in another account can directly trigger an execution in that account with an attacker-influenced payload.

An EventBridge rule with a Step Functions state machine as its target can start an execution when the rule matches; the EventBridge source is the event source, the state machine is the consumer.

Modify a state machine's ASL definition (states:UpdateStateMachine), then trigger an execution to run arbitrary AWS SDK Task states as the execution role.

Directly invoke a state machine (states:StartExecution) with an attacker-supplied input payload to execute as the machine's execution role.

A Step Functions state machine runs every execution as its configured IAM execution role.

A state machine exposes its execution role's credentials to any code injected into a Task state (AWS SDK calls are made with the execution role's session).

states:SendTaskSuccess / states:SendTaskFailure with a valid taskToken allows steering an active execution through branching logic or injecting data into downstream Task states.

Remove Shield Advanced DDoS protection from a resource (defense evasion, reduces DDoS coverage).

sns:Subscribe lets an attacker create a new subscription (EventRule binding) on the topic, routing future publishes to a chosen Lambda or SQS endpoint.

sns:SetTopicAttributes can modify topic configuration including KmsMasterKeyId (SSE), DeliveryPolicy, SignatureVersion, etc., enabling data-exposure and delivery attacks.

sns:SetTopicAttributes (Policy attribute) or sns:AddPermission rewrites or extends the SNS topic access policy, enabling self-grant of Publish/Subscribe or cross-account trust.

A principal with effective sns:Publish on an SNS topic can send messages to it, potentially triggering all bound subscribers.

sns:Subscribe lets an attacker add their own endpoint as a subscriber and receive all messages published to the topic, including embedded secrets.