Derivation rules

Reading snapshot data (CanReadData) that contains secrets (ContainsSecret) lets the principal extract and authenticate as the identity those secrets belong to - shorthand for the CanReadData → ContainsSecret → CredentialsFor chain into the CanReadSecret pivot. This rule feeds credential-chains.yaml: read-secret-yields-identity.

A volume is attached to an EC2 instance via ec2:DescribeVolumes.

Detaching a volume from a victim instance, attaching it to an attacker-controlled instance, modifying the filesystem (cron, SSH keys, startup scripts), and re-attaching enables both data write and indirect CanModifyConfiguration on the victim instance. This is the inverse of aws-ebs-volume-mount-read.

CreateVolume from an existing snapshot + AttachVolume to an attacker- controlled instance yields full filesystem read of the snapshot's data. This rule matches on direct IAM capability evaluation for both volume creation and attachment.

Attach an instance profile (role) to an instance the attacker can run code on.

CreateImage from a compromised instance bakes attacker-controlled disk contents into an AMI consumed by future launches (supply chain).

Run code on an instance that ExecutesAs a role -> execute as that role.

The instance itself exposes its role's credentials via IMDS.

Code running on an instance can read the instance-profile role token from IMDS.

Snapshot a peer instance's volume, create a volume from it, attach to an attacker instance and mount -> read on-disk secrets/keys without running code on the victim.

The mounted peer volume leaks any on-disk credentials/keys to the attacker who mounted it.

Swap the role an existing instance runs as.

RunInstances + PassRole -> launch an instance running as a chosen role, then read IMDS.

A repository resource policy grants ecr:PutImage to a principal in another AWS account, creating a cross-account supply-chain push trust.

An external principal granted ecr:PutImage via the repository's resource policy can push images (cross-account supply-chain attack).

A principal with ecr:DeleteRepositoryPolicy can delete the repository resource policy, removing all access controls and cross-account restrictions - policy-mutation escalation.

A principal with ecr:PutImageTagMutability can change an IMMUTABLE repository to MUTABLE, unblocking push overwrites on protected tags (prerequisite removal for CanModifyCode).

A public ECR repository is pull-accessible to any user on the internet without authentication, enabling supply-chain poisoning by external/anonymous attackers.

A principal with effective ecr:BatchGetImage + ecr:GetDownloadUrlForLayer can pull image layers, reading embedded secrets or proprietary code contained in the repository's images. For KMS-encrypted repositories, the principal must also hold kms:Decrypt on the repository's CMK.

An IAM principal with effective ecr:PutImage (+ layer-upload actions) on a repository can push/overwrite a mutable-tag image, injecting attacker code into every consumer that re-pulls that tag.

An image push to ECR emits EventBridge events (ecr:PutImage action emits ECR Image Action event) that can trigger downstream Compute workloads (Lambda, CodePipeline, deploy workers), enabling trigger-based code execution.

A principal with ecr:PutReplicationConfiguration can change the registry's replication destination settings, enabling supply-chain image interception and poisoning across all repositories in the account.

A registry-level replication policy allows an external account's repository to replicate images into the victim's registry, enabling cross-account supply-chain poisoning via the replication mechanism.

A principal with ecr:SetRepositoryPolicy can rewrite the repository resource policy to grant itself or any other principal push or pull access - policy-mutation escalation prerequisite.

Create a new ECS workload (task/service) bound to a passable task role.

EC2-launch container reaches host IMDS and reads the container-instance role.

ECS Exec runs OS commands inside a running container.

ECS Exec into a task -> execute as its task role.

Register + run an attacker container as a passable task role.

Redeploy an existing service onto an attacker task definition revision.

Task execution role reads Secrets Manager / SSM secrets referenced in the task definition.

Principal can pass a role to ECS tasks (iam:PassRole scoped to ecs-tasks).

RegisterTaskDefinition lets attacker author image/command/env and choose the task role.

RegisterTaskDefinition authors the image/command/entryPoint a task runs = ECS-native code-authoring primitive.

Create an EventBridge/Scheduler target that runs an ECS task as a passable role.

Code in an ECS task reads the task role's temp credentials from the metadata endpoint.

The ECS agent for a task executes as the task execution role (executionRoleArn).

A running ECS task executes as its configured task role (taskRoleArn).

A principal with elasticfilesystem:CreateMountTarget can place a new mount target in a subnet they control, gaining network access to the EFS file system.