Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
backup:StartRestoreJob provisions a new resource from a backup recovery point; the restored resource can be accessed if the principal also has target-service read permissions (RDS login, EC2 key pair, EFS mount, etc.).
backup:PutBackupVaultLockConfiguration allows locking a backup vault in compliance mode, preventing deletion of recovery points and vault access policy changes for a configured retention period - a persistence/ransomware primitive.
backup:PutBackupVaultAccessPolicy allows rewriting a backup vault's access policy, enabling an attacker to grant itself or an external account data-access permissions (StartRestoreJob, StartCopyJob).
Create/register Batch workload bound to a passed identity (create + pass).
Register a job definition with attacker code + a passed privileged jobRole, then submit it.
Submit an existing definition (with command override) whose bound jobRole is privileged - no PassRole needed.
On EC2 compute environments the container host executes as the ECS instance role.
A Batch job/task executes as the jobRoleArn bound to its job definition.
A privileged Batch container on an EC2 compute environment can read the instance role from IMDS.
SubmitJob with container command/environment overrides runs attacker-chosen code against an existing definition's image without registering a new revision.
An EventBridge rule / EventBridge Scheduler target or a Step Functions state that calls batch:SubmitJob against a definition is an attacker-reachable execution trigger.
Full control over an Elastic Beanstalk application (elasticbeanstalk:* or the admin managed policy).
Set or replace the instance profile / service role on an environment via option settings.
Environment option settings / environment properties often store plaintext secrets readable via DescribeConfigurationSettings.
Beanstalk environment provisions EC2 instances that run as the instance profile role.
Beanstalk service acts as the environment service role.
Beanstalk EC2 instances leak the instance profile creds via IMDS (169.254.169.254).
Code on a Beanstalk instance (or SSRF against the app) reads the instance profile creds from IMDS.
Register a new application version (S3 source bundle) and deploy it to an environment.
Change environment option settings (identity binding, env vars, platform hooks).
Restart/rebuild re-runs deploy hooks (.ebextensions) on the instances.
WebServer-tier environments front instances with an internet-facing ELB by default.
Redirect a Bedrock Agent action group's backing Lambda to an attacker-controlled Lambda, injecting code into the agent's execution path.
Swap a Bedrock Agent's execution role via UpdateAgent+PassRole to execute the orchestration loop as an attacker-chosen role.
Swap a Bedrock Knowledge Base's service role via UpdateKnowledgeBase+PassRole to access data sources as an attacker-chosen role.
Copying a package version into a CodeArtifact repository via CopyPackageVersions injects code into every consumer of that repository - supply-chain CanModifyCode.
Deleting the CodeArtifact domain resource policy removes all access controls and opens the publish surface to all principals with domain access - CanModifyPolicy via deletion.
Deleting a CodeArtifact repository resource policy removes all access controls and opens the publish surface for that repository - CanModifyPolicy via deletion.
A CodeArtifact domain resource policy that names a principal in another account creates a CrossAccountTrust that, combined with that principal's identity-policy grants, enables cross-account package publishing into this domain.
CodeArtifact GetAuthorizationToken returns a short-lived bearer credential (up to 12 hours) for authenticated repository access - a credential-access primitive often exfiltrated from CI/CD environments.
Adding an external connection to a CodeArtifact repository can enable dependency confusion by allowing public-registry packages to be resolved by downstream consumers.
UpdateRepository can add a malicious upstream repository to a victim repository's upstream chain, enabling packages from the attacker's repository to be resolved by the victim's consumers.
Rewriting the CodeArtifact domain resource policy can grant arbitrary principals publish access to all repositories in the domain - CanModifyPolicy over the domain policy node.
Rewriting a CodeArtifact repository resource policy can grant arbitrary principals publish access to that repository - CanModifyPolicy over the repository policy node.
Publishing a package version to a CodeArtifact repository injects code into every consumer that installs the package - supply-chain CanModifyCode.
A CodeArtifact repository resource policy that names a principal in another account creates a CrossAccountTrust enabling cross-account package reads or writes to that repository.
Publishing to an upstream repository propagates CanModifyCode to every downstream repository in the upstream chain whose consumers resolve packages through it.
codebuild:CreateWebhook allows a principal to add a new webhook trigger to a project, creating a POTENTIAL trigger surface that activates when qualifying VCS events fire.
Writing to the project's source repository/bucket on the tracked branch injects code into future builds when the buildspec is stored in-source.
codebuild:StartBuild allows supplying buildspecOverride, running arbitrary commands as the project's service role.
codebuild:StartBuildBatch allows supplying buildspecOverride for the primary build in the batch, running arbitrary commands as the project's service role.
codebuild:UpdateProject rewrites the project's stored buildspec, affecting all future builds.