Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
amplify:UpdateApp vpcConfig change enables build access to private VPC resources.
iam:PassRole scoped to amplify.amazonaws.com lets a principal attach a service role to an Amplify App.
amplify:StartJob fires a build of the branch, running its current buildSpec as the service role.
An API Gateway API that invokes a Lambda backend is an event source for that Lambda; invoking the API triggers the Lambda.
Changing an integration's credentials field to a more-privileged role (apigateway:PATCH + iam:PassRole) then invoking yields execution as the new role.
Create a new API Gateway API with an integration bound to a passable credentials role, then invoke it - yields execution as that role.
An API Gateway integration's credentials field references an IAM role; reading the integration config reveals which role the API uses as its execution identity.
Invoking an API Gateway API whose integration ExecutesAs a credentials role runs the integration as that role, yielding CanExecuteAs.
API Gateway invokes a Lambda authorizer function to evaluate access on every request (TOKEN or REQUEST type).
Modifying a REST API resource policy (apigateway:PATCH/PUT) to grant execute-api:Invoke to external principals or Principal '*'.
A REST API resource policy with Principal '*' and no VPC/IP restriction makes the API internet-callable.
appflow:* grants full administrative control over all AppFlow flows and connector profiles in scope.
An AppFlow connector profile's stored credential (OAuth token / API key) authenticates to the external SaaS system - reading the Secrets Manager secret yields a usable credential for that SaaS identity.
Creating a new AppFlow flow that references an existing connector profile and points to an attacker-controlled destination exfiltrates SaaS data without modifying any existing flow.
Redirecting an existing flow's destination to an attacker-controlled endpoint and triggering the flow exfiltrates the SaaS data it reads (Salesforce records, Zendesk tickets, Slack messages, etc.).
A principal with App Mesh route/service write actions can modify the Envoy xDS configuration delivered to mesh sidecars, redirecting in-mesh or inbound gateway traffic to an attacker-controlled virtual node (traffic hijack within the mesh).
apprunner:* grants full control of the service.
Update/CreateService + PassRole can attach/replace the identity the service runs as.
Supply-chain: poison the auto-deployed source -> run as the instance role.
Auto-deploy service redeploys on upstream ECR push / source commit.
Retarget InstanceRoleArn to a more-privileged role via UpdateService + PassRole.
CreateService deploys a new App Runner workload (attacker code/image).
Create a new App Runner service bound to a passed instance role -> execute as it.
Running service exposes instance-role credentials via the container credential endpoint.
UpdateService can rewrite the code (build/start command) or image an App Runner service runs.
Modify code/image of a service that already has an instance role -> run as that role.
UpdateService can change instance role, start command, env vars, secrets, and egress.
iam:PassRole scoped to App Runner lets a principal attach an instance/access role.
Code executing on the service can fetch the instance role's session token.
StartDeployment redeploys latest source/image (realizes poisoned code / auto-deploy).
Create a launch configuration that embeds a privileged instance profile, then point an ASG at it.
Create an Auto Scaling group whose launch template/config runs instances as a chosen instance-profile role.
Roll-up: create/update/point an ASG at an instance profile and get code running as its role.
Force an ASG to launch fresh instances so attacker-modified config/identity takes effect.
Instances launched by the ASG expose the instance-profile role's credentials via IMDS.
Modify the $Latest/$Default launch-template version an ASG uses; the ASG service-linked role launches with the chosen instance profile even without caller iam:PassRole.
Reading a launch template/config exposes hardcoded secrets/credentials embedded in UserData or launch data.
Alter launch template/config UserData or ImageId so newly launched instances execute attacker-controlled boot code.
Caller can pass an instance-profile role to EC2 through an Auto Scaling launch template/config.
Update an ASG / swap its launch template or config to launch instances as a more-privileged instance-profile role.
athena:UpdateWorkGroup lets a principal rewrite the workgroup output S3 location, redirecting subsequent users' query results to an attacker-controlled bucket.
A principal with athena:StartQueryExecution on a LAMBDA-catalog workgroup can trigger the registered Lambda connector function.
athena:StartQueryExecution on an enabled workgroup, combined with s3:GetObject on the data prefix, s3:PutObject on the results output location, and Glue read permissions, enables the principal to read underlying data-lake content.
An Athena workgroup configured with a LAMBDA data catalog triggers the registered Lambda connector function.
backup:StartCopyJob copies individual recovery points from a backup vault to a vault in a different AWS account, enabling complete data exfiltration by restoring the copied backups in the attacker's account.