Derivation rules

Forging a CA-trusted cert lets the principal act as the downstream identity.

amplify:CreateApp + iam:PassRole creates a new Amplify App bound to a chosen service role.

An Amplify App build exposes the service role's session credentials to code running in the build.

iam:PassRole scoped to amplify.amazonaws.com lets a principal attach a service role to an Amplify App.

Principal can create a CodeBuild project bound to a passed identity (create + PassRole).

Create a new CodeBuild project bound to a passable privileged role and start a build to execute as that role.

UpdateProject + PassRole swaps the service role of an existing project; the next build runs as the new (attacker-chosen) role.

A CodeBuild project runs every build as its configured IAM service role.

The build container exposes the project service role's short-lived credentials via the ECS task-credential endpoint.

iam:PassRole to codebuild.amazonaws.com lets the principal assign any passable role as the project service role (via CreateProject or UpdateProject).

CodeDeploy lifecycle hook scripts (running as root on EC2/on-prem targets) can read the instance profile role credentials from IMDS, exposing them to the attacker's code.

An IAM principal with cognito-identity:GetOpenIdTokenForDeveloperIdentity can synthesize a developer-authenticated token for any developerUserId in the pool and exchange it for the authenticated role's IAM credentials, bypassing user authentication entirely.

iam:PassRole for a DAX service role + dax:CreateCluster creates a DAX cluster executing DynamoDB requests as the passed role - AWS-specific single-action PassRole pattern.

A Kubernetes ServiceAccount annotated with eks.amazonaws.com/role-arn and a matching IAM role trust policy (Federated = cluster OIDC issuer) lets any pod running as that KSA exchange its projected token for IAM role credentials via sts:AssumeRoleWithWebIdentity. Cites container-chains workload-identity-federates and federation-chains federation-maps-to-identity.

Pods on EC2 managed nodes with IMDS hop-limit >= 2 can reach 169.254.169.254 and retrieve temporary credentials for the node group IAM role. Any code execution inside such a pod inherits the node role without any IRSA or Pod Identity annotation.

Exec into a running pod (via cluster-admin or direct pods/exec RBAC) inherits the pod's mounted IRSA or Pod Identity token, executing as the pod's IAM role. Cites container-chains cluster-rbac-exec; dedupes on (CanExecuteAs, principal, role).

An EKS Pod Identity Association (eks:CreatePodIdentityAssociation) links a Kubernetes namespace:ServiceAccount pair to an IAM role. Pods running as that SA receive IAM credentials from the eks-pod-identity-agent at 169.254.170.23. Whoever can create or modify this association can reroute which IAM role any pod in that namespace:SA binding runs as.

Create a new image pipeline with an infrastructure configuration that uses a passable IAM role as its instance profile, then trigger a build to execute as that role.

Create a new malicious component version, update the pipeline to reference it, and trigger a build to execute shell commands as the build instance's IAM role.

Replace the infrastructure configuration's instance profile with a higher-privilege IAM role (UpdateInfrastructureConfiguration + iam:PassRole), then trigger a build to execute as that role.

Trigger an Image Builder pipeline whose current definition already executes attacker-influenced code (e.g., an S3-overwritable component URI or an already-tampered component version), executing as the build instance role.

Update an image pipeline to reference an attacker-controlled recipe (which may include malicious components or an S3-overwritable component URI), then trigger a build to execute as the build instance role.

Signing with a key that anchors an auth system forges the trusted identity.

Creating a new MSK Connect connector bound to a passable execution role is CanCreateWorkloadAs: code in the connector runs as that role.

An MSK Connect connector runs its plugin code as the configured IAM service execution role.

An MSK Connect connector exposes its service execution role credentials to all plugin code running within it via the ECS task-credential endpoint.

iam:PassRole to kafkaconnect.amazonaws.com allows the principal to bind any passable role to an MSK Connect connector.

Creating a new MSK Replicator bound to a passable execution role is CanCreateWorkloadAs: replication tasks run as that role.

iam:PassRole to kafka.amazonaws.com allows the principal to bind any passable role as the replication execution role of a new MSK Replicator.

OpsWorks-managed EC2 instance runs as its IAM instance profile role.

OpsWorks Stack's control plane operates as the stack's service role.

An OpsWorks-managed EC2 instance exposes its instance profile role credentials to any code that runs on it (via IMDS).

Create a new Redshift cluster (or Serverless namespace) with an attacker-chosen IAM role attached, then run queries as that role.

Pass a privileged IAM role to a Redshift cluster (iam:PassRole + ModifyClusterIamRoles), then submit a COPY/UNLOAD/UDF query that uses that role's AWS permissions. Covers both already-attached and attach-new-then-execute paths.

s3:CreateJob + iam:PassRole for a privileged IAM role creates an S3 Batch Operations job that runs as that role - a CanCreateWorkloadAs pattern for S3 Batch.

Create a new SageMaker compute resource (training/processing job, notebook, pipeline) bound to a passed privileged role - the canonical SageMaker PassRole privesc pattern.

An MLflow Tracking Server executes as its RoleArn.

A SageMaker Model executes as its ExecutionRoleArn at serving (endpoint) and batch-transform time.

A SageMaker notebook instance executes kernel code as its RoleArn (execution role).

A SageMaker Pipeline execution runs steps as its RoleArn.

A SageMaker processing job container executes as its RoleArn.

A SageMaker Studio App (JupyterServer/KernelGateway) executes as the UserProfile's ExecutionRole.

A SageMaker training job container executes as its RoleArn.

SageMaker compute surfaces (notebook/training/processing job/pipeline/Studio app) expose execution-role credentials to all code running inside them via IMDS or the container credentials endpoint.

iam:PassRole to sagemaker.amazonaws.com for model creation, binding a role to be used at serving/transform time.

iam:PassRole to sagemaker.amazonaws.com for notebook instance creation.

iam:PassRole to sagemaker.amazonaws.com for pipeline creation, giving attacker-controlled pipeline steps the passed role's credentials.

iam:PassRole to sagemaker.amazonaws.com for training/processing/hyperparameter-tuning/compilation job creation.