Derivation rules

config:ListAggregateDiscoveredResources or config:BatchGetAggregateResourceConfig on a Config Aggregator exposes cross-account resource inventory and configurations - recon primitive.

config:PutRemediationConfigurations + iam:PassRole sets the AutomationAssumeRole on a Config remediation configuration; when triggered, Config invokes SSM Automation as that role, yielding code execution as the passed role.

Create a new role with admin trust + policy, then assume it.

Creating a managed account via Account Factory yields a new account pre-seeded with an admin role the creator can assume - creation is entry.

Deregistering an OU from Control Tower governance (or reparenting accounts) removes the inherited SCP guardrails from those accounts.

Disabling or updating a Control Tower preventive control modifies the SCP guardrail backing it, removing its deny.

A management-account principal that can assume AWSControlTowerExecution enters every enrolled member account as administrator.

Documentation-only: Control Tower SCPs that exempt AWSControlTowerExecution mean a session obtained via that role is not subject to those preventive guardrails. No distinct edge is emitted; annotates rule 1's CanEnterAccount.

Control Tower landing-zone administration is effectively organization administration.

datapipeline:ActivatePipeline starts a pipeline run, completing the execution path when combined with CanModifyCode on the pipeline's definition.

datapipeline:AddTags allows altering pipeline tags used in IAM conditions, potentially defeating tag-based access restrictions.

datapipeline:CreatePipeline + iam:PassRole for a role (resourceRole passable to ec2.amazonaws.com) lets the principal spawn a new pipeline workload running as that role.

Explicit extraction: pipeline definition contains plaintext credential material in activity fields.

Executing as a more-privileged Data Pipeline resourceRole or pipeline role is privilege escalation - an ACTIVE CanExecuteAs where the target role outranks the attacker.

Inject shell commands into an existing pipeline definition and activate it to execute as the resourceRole already bound to that pipeline - no iam:PassRole needed.

Create a pipeline with a ShellCommandActivity injecting attacker commands, pass a privileged role as resourceRole, and activate: the EC2 resource runs attacker code as that role. The classic Data Pipeline PassRole RCE.

The Data Pipeline service assumes the pipeline's `role` field to provision compute resources and access downstream AWS services on the pipeline's behalf.

A pipeline's EC2 or EMR resource node executes as the IAM role in the pipeline's resourceRole field, making that role reachable via IMDS by any code the pipeline runs.

A pipeline's EC2 or EMR resource node exposes the resourceRole's temporary credentials to any code running in its activities via the IMDS endpoint.

iam:PassRole on a role that trusts datapipeline.amazonaws.com lets the principal bind it as the pipeline role, used by the Data Pipeline service to provision EC2/EMR resources and access downstream AWS services.

iam:PassRole on a role that trusts ec2.amazonaws.com lets the principal bind it as the resourceRole in a Data Pipeline definition, enabling code running on the EC2/EMR node to execute as that role.

Explicit extraction: the Data Pipeline service assumes the role specified in the role field.

Explicit extraction: a pipeline's EC2 or EMR resource node runs as the IAM role specified in the resourceRole field.

datapipeline:PutPipelineDefinition replaces the pipeline object graph including shell commands and scriptUri, giving the principal arbitrary code control over the pipeline's activities.

datapipeline:PutPipelineDefinition rewrites the pipeline's role, resourceRole, schedule, and cluster configuration - changing execution identity or trigger requires iam:PassRole for the new role.

datapipeline:SetStatus can force-resume stalled pipeline objects, effectively re-triggering activities - an alternative to ActivatePipeline.

Deleting the Detective behavior graph is a defense-evasion / cover-tracks primitive that reduces investigative coverage (ADMINISTRATOR ONLY). Emits CanModifyConfiguration on the SecurityService node.

A member account can remove itself from a Detective behavior graph (detective:DisassociateMembership). This is a self-removal action with reduced scope. Emits CONDITIONAL CanModifyConfiguration.

Forcibly removing a member account from a Detective behavior graph (detective:DeleteMembers) is a defense-evasion primitive (ADMINISTRATOR ONLY). Emits CanModifyConfiguration on the SecurityService node.

Modifying organization-wide Detective configuration (UpdateOrganizationConfiguration, EnableOrganizationAdminAccount) weakens the org's investigative posture. Emits CanModifyConfiguration on the Organization scope.

IAM principal with directconnect:DeleteVirtualInterface can disrupt existing Direct Connect routing (availability impact, not escalation).

A Direct Connect Gateway-to-TransitGateway association spanning account boundaries establishes network-layer trust (on-prem has routed path into remote account's VPCs).

A Direct Connect Gateway with an accepted association to a TransitGateway routes on-premises traffic to the TGW and its attached VPCs.

IAM principal with Direct Connect write actions can create or modify virtual interfaces and DXGW associations, altering which networks have a routed path into AWS VPCs (network topology manipulation). Covers constructive/expansive actions only (Create, Update, Accept); Delete actions are modeled separately as CanDelete.

A private or transit Direct Connect Virtual Interface in AVAILABLE state routes the on-premises network into the attached VGW or DXGW, establishing a non-internet routed path from on-prem into AWS private address space.

Principal with rds:ModifyDBCluster on the cluster resource ARN can modify cluster configuration, including resetting the master user password without knowing the current password.

DocumentDB cluster stores its master MongoDB user password in a Secrets Manager secret when ManageMasterUserPassword is enabled.

rds:CopyDBClusterSnapshot + rds:ModifyDBClusterSnapshotAttribute together enable exfiltration of automated DocumentDB cluster snapshots: copy an automated snapshot to manual, then share the manual copy cross-account or publicly.

rds:ModifyDBCluster with MasterUserPassword resets the cluster's master password to an attacker-known value, granting superuser MongoDB access without knowing the current password - a single control-plane escalation primitive.

A DocumentDB cluster with PubliclyAccessible=true and a VPC security group permitting inbound TCP 27017 from 0.0.0.0/0 or ::/0 is network-reachable from the public internet. Valid MongoDB credentials (obtained via credential-grab paths) enable connection without VPC foothold.

A principal that can read the DocumentDB master-password secret from Secrets Manager can authenticate to the cluster as the master MongoDB user, gaining full data-plane access (read/write/drop) across all databases on the cluster.