Derivation rules

A CloudHSM client host with a configured CU login leaks it to any code it runs.

Signing with an HSM key that issues tokens/certs for a more-privileged identity is escalation.

A CloudHSM CU credential (with VPC reach) can sign with the HSM private key.

Principal with cloudtrail:DeleteEventDataStore can permanently destroy a CloudTrail Lake event data store, eliminating the long-term audit retention store for the organization. This is a high-impact anti-forensic primitive.

Principal with cloudtrail:DeleteTrail can permanently destroy a trail, creating an irreversible audit blind spot. Existing S3 log objects are unaffected; only future event capture is eliminated.

Principal with cloudtrail:DeregisterOrganizationDelegatedAdmin can remove the delegated admin role from an account, preventing it from managing organization trails and reducing the security team's ability to respond to and restore logging. This is a persistence / evasion amplifier in multi-account environments.

Principal with cloudtrail:UpdateEventDataStore can disable ingestion (IngestionEnabled: false) on a CloudTrail Lake event data store, halting new audit-event collection while the store remains accessible - a reversible detection-suppression primitive.

Principal with cloudtrail:LookupEvents can query 90 days of account-wide management-event history without S3 access, exposing IAM principal names, access-key IDs, resource ARNs, and error codes - useful for recon and lateral movement planning.

Principal with cloudtrail:PutEventSelectors can exclude attacker-used API principals, actions, or data-event prefixes from capture, creating selective audit blindness while leaving the trail apparently running.

Principal with cloudtrail:UpdateTrail can redirect S3 log delivery to an attacker-controlled bucket, enabling silent log exfiltration while the trail remains IsLogging=true. This is a log-redirect-to-attacker-bucket exfiltration capability, distinct from selector narrowing.

Principal with cloudtrail:StopLogging can pause event recording on a trail, suppressing the audit record of all subsequent API activity until logging is resumed - a defense-evasion / cover-tracks primitive.

Principal with cloudtrail:UpdateTrail but no PutEventSelectors can update trail metadata (description, tags) without impactful defense-evasion capability. This rule is a SUPPRESS-IF-ONLY-UPDATETRAIL gate - do not emit an edge when UpdateTrail is the only action AND the effective policy scope does not include S3 bucket redirection or IncludeManagementEvents disable.

cloudwatch:DeleteAlarms permanently removes one or more CloudWatch alarms, eliminating the detective control entirely - a higher-impact, more-detectable evasion than DisableAlarmActions.

logs:DeleteLogGroup permanently deletes a log group and all its stored events - evidence destruction that eliminates forensic audit records.

cloudwatch:DisableAlarmActions silences alarm response automation (SNS/Lambda/SSM actions) without deleting the alarm - a stealthy detection-evasion primitive.

cloudwatch:PutMetricAlarm creates or overwrites an alarm definition, enabling alarm suppression via threshold manipulation, action redirection, or metric/expression rewriting - a high-impact evasion primitive.

logs:GetLogEvents, logs:FilterLogEvents, or logs:StartQuery + logs:GetQueryResults on a log group enables reading raw log events from the LoggingService node; application logs frequently embed secrets, tokens, or credentials usable for credential harvest.

logs:DeleteMetricFilter or logs:PutMetricFilter on a log group removes or corrupts the metric filter expression that feeds CloudWatch alarms, creating a detection blind spot.

logs:DeleteSubscriptionFilter or logs:PutSubscriptionFilter on a log group cuts or redirects real-time log delivery to a SIEM, security data lake, or Lambda-based alert processor.

Create a deployment with an attacker-controlled revision; hook scripts run as root on every EC2/on-prem instance in the deployment group, yielding fleet-wide command execution.

Create a new CodeDeploy deployment group with any passable role as the service role, creating a workload bound to a chosen identity.

CodeDeploy lifecycle hook scripts (running as root on EC2/on-prem targets) can read the instance profile role credentials from IMDS, exposing them to the attacker's code.

CodeDeploy invokes the pre/post-traffic hook Lambda function specified in the AppSpec; CreateDeployment on a Lambda-platform group lets the attacker choose which Lambda gets invoked.

A CodePipeline Deploy stage action invokes the CodeDeploy deployment group; emit CanTrigger from the pipeline's execution identity so cicd-chains propagates pipeline-level trigger capability.

Trigger a deployment to execute orchestration-plane actions as the deployment group's service role - requires a run path.

PutApprovalResult APPROVE on a manual approval gate unblocks the downstream stage runner, enabling a principal who can trigger the pipeline AND approve the gate to reach stages that were otherwise CONDITIONAL(stage_reachable).

Write access to the pipeline's artifact store S3 bucket/prefix lets an attacker inject a malicious artifact that the next pipeline stage processes as the stage's action role - supply-chain code injection into the pipeline.

Principal with codepipeline:CreatePipeline can deploy new pipelines to the CodePipeline platform.

StartPipelineExecution over a pipeline whose current definition already runs attacker-influenced code (poisoned artifact, malicious source commit, unpinned dependency) yields execution as the pipeline's service/action role; cicd-chains rule 2 is the canonical collapse (CONDITIONAL).

A Cognito-authenticated federated identity presents a valid pool token to receive temporary IAM credentials for the authenticated role. When the role trust condition is broad (authenticated but any provider), any authenticated pool user - regardless of the provider used - receives the role.

An IAM principal with cognito-identity:GetOpenIdTokenForDeveloperIdentity can synthesize a developer-authenticated token for any developerUserId in the pool and exchange it for the authenticated role's IAM credentials, bypassing user authentication entirely.

An Identity Pool role mapping rule selects a privileged IAM role based on a token claim value the pool user can write (e.g. a custom User Pool attribute updatable via UpdateUserAttributes), enabling self-escalation to the mapped role.

An Identity Pool with AllowUnauthenticatedIdentities=true lets any internet user call GetId + GetCredentialsForIdentity (no credentials required) to receive temporary IAM credentials for the unauthenticated role.