Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
athena:UpdateWorkGroup lets a principal rewrite the workgroup output S3 location, redirecting subsequent users' query results to an attacker-controlled bucket.
A principal with athena:StartQueryExecution on a LAMBDA-catalog workgroup can trigger the registered Lambda connector function.
athena:StartQueryExecution on an enabled workgroup, combined with s3:GetObject on the data prefix, s3:PutObject on the results output location, and Glue read permissions, enables the principal to read underlying data-lake content.
An Athena workgroup configured with a LAMBDA data catalog triggers the registered Lambda connector function.
Swap a Bedrock Knowledge Base's service role via UpdateKnowledgeBase+PassRole to access data sources as an attacker-chosen role.
A pipeline's EC2 or EMR resource node exposes the resourceRole's temporary credentials to any code running in its activities via the IMDS endpoint.
elasticmapreduce:AddJobFlowSteps lets a principal inject arbitrary executable steps into a running cluster.
An EMR cluster whose instance profile has s3:GetObject on a data lake bucket can read all objects in that bucket.
S3 URI where EMR cluster logs are written; record as a resource reference for data discovery.
Submit a step to a running EMR cluster via AddJobFlowSteps; the step executes as the cluster's instance profile role without iam:PassRole.
Create a new EMR cluster with a privileged JobFlowRole via RunJobFlow + iam:PassRole; arbitrary bootstrap/step code executes as that role.
An EMR cluster and every step/application running on it execute as the cluster's EC2 instance profile (JobFlowRole).
An EMR cluster whose instance profile has s3:PutObject on an attacker-controlled S3 bucket can exfiltrate data via Spark df.write or Hive INSERT OVERWRITE DIRECTORY.
Every EC2 node in an EMR cluster exposes the instance profile (JobFlowRole) credentials via the EC2 Instance Metadata Service (IMDS); any code running on the cluster can retrieve them.
Every EC2 node in an EMR cluster exposes the instance profile (JobFlowRole) credentials via the EC2 Instance Metadata Service (IMDS); any code running on the cluster can retrieve them.
Submit an EMR on EKS job run with attacker-controlled application code and a passed privileged execution role via emr-containers:StartJobRun + iam:PassRole.
An EMR on EKS job run executes as the IAM role bound to the virtual cluster's job execution binding (IRSA).
emr-containers:StartJobRun lets a principal submit a Spark/Hive job with attacker-controlled application code on an EKS-hosted EMR virtual cluster.
elasticmapreduce:RunJobFlow lets a principal create a new cluster with attacker-chosen bootstrap actions, AMI, and steps.
Submit an EMR Serverless job run with attacker-controlled application code and a passed privileged executionRole via emr-serverless:StartJobRun + iam:PassRole.
An EMR Serverless job run executes as the executionRoleArn provided at StartJobRun.
emr-serverless:StartJobRun lets a principal submit a Spark/Hive job with attacker-controlled application code.
Write to EMR Studio workspace S3 backing to inject code into notebooks; notebook execution runs as Studio service role or attached cluster's JobFlowRole.
s3:PutObject on a bucket that is a verified code-artifact deployment source (Lambda, CodePipeline, CloudFormation) for a compute workload equals modifying that workload's code.
Attach a user-assigned managed identity to a Data Factory (factories/write + assign/action on the MI), binding a higher-privilege identity to the factory's pipeline runs.
An ADF factory with publicNetworkAccess=Enabled exposes its REST data-plane endpoint (adfstudio.azure.com + management.azure.com) to the internet.
Full ARM control of the AML workspace grants administrative authority over all compute, jobs, datastores, and linked services.
Databricks workspace REST API endpoint is publicly reachable; any token/PAT holder can authenticate from the internet.
Attach a user-assigned MI to the workspace (workspaces/write + assign/action); all Spark jobs and pipelines then run as both the system-assigned MI and the newly attached user-assigned MI.
bigDataPools/write allows uploading custom library packages to a Spark pool; those libraries execute on Spark workers running as the workspace MI.
Synapse Artifact Publisher role allows creating schedule/event/tumbling-window triggers that repeatedly run pipelines - persistence mechanism for code execution as the workspace MI.
Attach a privileged user-assigned MI to the workspace (CanAttachIdentity) + workspace gains a new ExecutesAs target -> all Spark/pipeline runs can mint tokens for the attached MI.
Synapse workspace development, SQL, and Spark endpoints are public-internet reachable when publicNetworkAccess is Enabled and no private-endpoint-only restriction is applied.
Retrieve IR auth key (CanReadSecret) + register a self-hosted IR node the attacker controls -> that node executes pipeline activities as the workspace MI. No generic linchpin covers this path; rule is Synapse-specific.
Upload malicious library to a Spark pool (CanModifyCode) + the pool runs as the workspace MI (ExecutesAs) => execute code as the workspace MI. Cites can-execute-as.yaml execute-as-via-code-modify.
Publish a pipeline with attacker code (CanModifyCode on workspace) + trigger it (CanTrigger) + workspace ExecutesAs MI => execute as workspace MI. Cites cicd-chains.yaml cicd-modify-buildspec-executes-as and can-execute-as.yaml.
Synapse Compute Operator submits a Spark batch job via Livy API (CanExecuteCommand) + Spark pool runs as workspace MI (ExecutesAs) => execute attacker code as the workspace MI.
Any code running on Synapse Spark/pipeline compute can mint a bearer token for the workspace MI via IMDS.
Synapse Artifact Publisher role allows publishing pipelines with arbitrary Spark/custom/web activities; the workspace Workflow node executes them as the workspace MI.
Synapse Compute Operator role allows triggering pipeline runs (createPipelineRun) on the workspace, executing whatever pipeline definition is currently published.
CREATE EXTERNAL TABLE AS SELECT (CETAS) on the serverless SQL pool exports query results to an external storage location; if the workspace MI holds write access on attacker-controlled storage, data is exfiltrated.
Synapse Compute Operator can submit Spark batch jobs and interactive sessions directly via the Apache Livy REST API endpoint at <workspace>.dev.azuresynapse.net/livyApi/..., triggering immediate job execution.
Synapse Compute Operator role (or Synapse Administrator) allows submitting Spark batch jobs and interactive sessions via the Livy API, running attacker-supplied code on Spark workers.
The Synapse workspace exposes the workspace managed identity credential to all Spark jobs and pipeline activities via IMDS (169.254.169.254).
workspaces/write allows changing the workspace identity block (attach/detach user-assigned MI), firewall rules, AAD admin, and integration runtime config - all alter execution identity or reach.
Modify code of a compute resource that runs as a privileged identity.
CanExecuteAs
derived