Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
A confirmed active SNS subscription binds the topic to its consumer; every Publish invokes the consumer with the message payload.
An SNS topic without a DataProtectionPolicy may carry messages embedding secrets; any subscriber can read them (POTENTIAL - content heuristic, not confirmed).
An SNS topic access policy granting sns:Publish to Principal '*' is internet-accessible - anyone can publish and trigger all subscribers.
A queue resource policy granting sqs:SendMessage to a principal in another account is cross-account publish trust; fed by messaging-chains rule 4 to derive CanEnterAccount.
An SQS queue with Principal:* granting sqs:SendMessage (no condition) is publicly writable; any unauthenticated sender can trigger bound Lambda consumers via messaging-chains.
sqs:ReceiveMessage on a queue is a data-plane read; if the queue carries credentials (ContainsSecret), credential-chains derives CanImpersonate.
sqs:SendMessage on a queue is a data-plane publish: the principal can send attacker-influenced messages that drive event-source consumers. Consumed by messaging-chains.
sqs:SetQueueAttributes allows rewriting the queue resource policy (Policy attribute), enabling self-grant of sqs:SendMessage and the downstream trigger chain.
A State Manager association with a cron schedule triggers the bound document against targeted instances automatically.
ssm:StartChangeRequestExecution triggers an Automation runbook with Change Manager approval gating.
Create a new State Manager association with a privileged role and attacker-controlled document parameters, yielding recurring scheduled code execution as that role.
Create a new Automation document with attacker-controlled steps and bind a passable privileged role, yielding code execution as that role.
A principal in account A that can execute commands on an instance in account B, which runs as a role in account B, gains a foothold in account B.
A managed instance exposes its instance-profile role credentials to any code running on it via the IMDS endpoint.
A consumer reads a RAM-shared SecureString whose creds grant the owning account.
Reading a SecureString that holds creds for a more-privileged identity is escalation.
A SecureString parameter exposes credential material to any reader.
A SecureString parameter's value authenticates as the target identity/service.
aws
Overwrite a parameter's value (ssm:PutParameter Overwrite) to poison consumers.
Register a Run Command / Automation task with a Maintenance Window, binding a privileged service role that the task will run as.
ssm:SendCommand delivers attacker-controlled commands to a managed instance, yielding OS-level execution as root/SYSTEM.
A shared SSM Automation document gives the sharing-account identity code control over any BuildWorker in the target account that executes it.
ssm:StartAutomationExecution triggers an existing Automation BuildWorker runner that executes as its AutomationAssumeRole.
ssm:StartSession opens an interactive WebSocket shell to a managed instance, bypassing firewall rules.
ssm:UpdateAssociation changes the document or command parameters of a State Manager association, injecting attacker code into the managed instances the association targets.
ssm:UpdateDocument rewrites a customer-owned Automation document's steps - the executed definition of the BuildWorker runner.
A principal that can attach a policy to a permission set (via sso:PutInlinePolicyToPermissionSet or sso:AttachManagedPolicyToPermissionSet) widens the effective permissions of every current assignee of that permission set across all assigned accounts.
A principal with sso:CreateAccountAssignment can assign any user or group to any permission set (including AdministratorAccess) in any member account, granting org-wide privilege - the SSO equivalent of iam:AttachUserPolicy at org scope.
A principal with identitystore:CreateUser can inject a phantom user into the Identity Store. The phantom user has no privilege until assigned via CreateGroupMembership (rule 4) or CreateAccountAssignment (rule 1); this rule documents the capability to create, not the escalation.