Derivation rules

iam:PassRole to sagemaker.amazonaws.com for MLflow tracking server role updates.

CreatePresignedDomainUrl opens a Studio session as the specified user profile's execution role - no iam:PassRole required.

CreatePresignedNotebookInstanceUrl opens a browser-based Jupyter shell on a running notebook, giving the caller immediate code execution as the notebook's execution role - no iam:PassRole required.

Create a new Step Functions state machine bound to any role passable to states.amazonaws.com, then start an execution to run arbitrary Task states as that role.

Modify a state machine's ASL definition (states:UpdateStateMachine), then trigger an execution to run arbitrary AWS SDK Task states as the execution role.

Directly invoke a state machine (states:StartExecution) with an attacker-supplied input payload to execute as the machine's execution role.

A Step Functions state machine runs every execution as its configured IAM execution role.

A state machine exposes its execution role's credentials to any code injected into a Task state (AWS SDK calls are made with the execution role's session).

Cluster-admin kubeconfig -> exec any pod -> execute as every pod workload identity (cluster-wide summary edge; per-pod edges from container-chains cluster-rbac-exec).

Node-level code execution (privileged pod, hostPID, DaemonSet exec) reaches the node IMDS and mints a token for the node system-assigned / kubelet MI.

runCommand grants cluster-wide kubectl exec; any pod's workload identity is reachable by exec-ing into the pod (container-chains cluster-rbac-exec).

An ARM service connection (secret-based) injects the backing SP's client secret / certificate into the job environment; pipeline code can read and exfiltrate it.

A principal that can CanExecuteAs the pipeline's service-connection identity, where that identity holds ARM Contributor/Owner at subscription scope, gains a foothold in that Azure subscription.

A self-hosted pipeline agent (VirtualMachine) runs as its OS user / managed identity, providing a second execution identity for all pipelines on that agent.

A WIF service connection lets a pipeline job request a short-lived Azure DevOps OIDC token that is then exchanged for an ARM access token; any code in the job can call the OIDC endpoint.

A service principal holding Application.ReadWrite.All can add itself as the owner of any app registration, granting it permanent owner-level control (credential addition, configuration change) independent of the original permission grant.

A service principal holding Application.ReadWrite.All (or Directory.ReadWrite.All) can add a password or certificate credential to any app registration or service principal in the tenant and then authenticate as that identity, inheriting all its permissions - the identity-plane equivalent of sts:AssumeRole.

A service principal holding Application.ReadWrite.All or Directory.ReadWrite.All can modify the trust configuration of any app registration by adding a federated identity credential (OIDC trust), allowing an attacker-controlled external issuer to obtain tokens as that app without a static secret.

A service principal holding Group.ReadWrite.All, GroupMember.ReadWrite.All, or Directory.ReadWrite.All can add any principal (including itself) to any Entra group, inheriting that group's RBAC role assignments, Graph app role assignments, and any other entitlements the group carries.

A service principal holding RoleManagement.ReadWrite.Directory can assign any Entra directory role (including Global Administrator) to any principal, achieving tenant takeover - the app-permission equivalent of holding Privileged Role Administrator.

A service principal holding User.ReadWrite.All (or Directory.ReadWrite.All) can reset any non-protected Entra user's password via PATCH /users/{id} with a new passwordProfile, taking over that user's account and inheriting their RBAC and group memberships.

An external CI system (GitHub Actions/GitLab CI/Azure DevOps) with an OIDC/WIF trust into a cloud role/SA can federate in as that identity; escalation roll-ups are federation-chains'.

Exec into a pod (cluster RBAC / credential / run-command) inherits the pod's mounted ServiceAccount/IRSA/Workload-Identity token, executing as that identity.

Federating in as an internal Role/ServiceAccount lets the principal act AS it, inheriting its outbound capabilities; rolled up as CanImpersonate.

Federating into a Role homed in an AWS account gives the federated principal a foothold in that account.

Federating into a ServiceAccount homed in a GCP project gives the federated principal a foothold in that project.

A realized external->internal identity mapping whose trust condition an attacker-controlled external identity can satisfy yields federation into the internal identity.

Issuing a certificate from a CA that is the trust anchor of a federation lets the issuer mint a matching external identity and federate in.

Issue a cert for an attacker-chosen subject/SAN that a downstream trust accepts, impersonating that identity.

cloudbuild.builds.create + iam.serviceAccounts.actAs on a user SA: submit arbitrary build steps as that SA.

cloudbuild.triggers.create + iam.serviceAccounts.actAs: create a new trigger whose builds execute attacker-controlled steps as a chosen SA.

cloudbuild.triggers.update lets the principal replace a trigger's build definition (inline steps, cloudbuild.yaml path, or substitutions); the next trigger fire executes the attacker-controlled definition as the trigger's SA.

Holding CanPassIdentity on a target SA plus composer.environments.create gives the principal the ability to create a Composer environment running as that SA.

composer.environments.update + iam.serviceAccounts.actAs on a new SA: swap the Composer environment's runtime SA; future DAG tasks run as the new SA.

Create a new Dataflow job whose workers run as a passable SA (dataflow.jobs.create + iam.serviceAccounts.actAs).

datafusion.instances.create + iam.serviceAccounts.actAs on a target SA: create a new Data Fusion instance whose pipelines execute as that SA.

datafusion.instances.update + iam.serviceAccounts.actAs on a target SA lets a principal replace the dataprocServiceAccount; all future pipeline runs execute as the new SA.

Reading a credential that is credentials for an identity yields the ability to authenticate as that identity.

Reading a secret that is credentials for an identity yields the ability to authenticate as that identity.

Signing tokens as an identity yields impersonation when a downstream trust validates those signatures.

A Kubernetes workload-identity binding (KSA<->GSA / IRSA / AKS Workload Identity) lets the pod's projected SA token federate into a cloud Role/ServiceAccount; escalation roll-ups are federation-chains'.