Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
Cross-account issuance on a CA whose certs are trusted in the owner account enters that account.
A REST API resource policy with Principal '*' and no VPC/IP restriction makes the API internet-callable.
Deleting the CodeArtifact domain resource policy removes all access controls and opens the publish surface to all principals with domain access - CanModifyPolicy via deletion.
Deleting a CodeArtifact repository resource policy removes all access controls and opens the publish surface for that repository - CanModifyPolicy via deletion.
A CodeArtifact domain resource policy that names a principal in another account creates a CrossAccountTrust that, combined with that principal's identity-policy grants, enables cross-account package publishing into this domain.
Rewriting the CodeArtifact domain resource policy can grant arbitrary principals publish access to all repositories in the domain - CanModifyPolicy over the domain policy node.
Rewriting a CodeArtifact repository resource policy can grant arbitrary principals publish access to that repository - CanModifyPolicy over the repository policy node.
A CodeArtifact repository resource policy that names a principal in another account creates a CrossAccountTrust enabling cross-account package reads or writes to that repository.
An EventBridge custom bus resource policy granting events:PutEvents to a principal in another account establishes cross-account publish trust; the external principal can inject events that trigger compute consumers in this account.
An EventBridge custom bus policy granting events:PutEvents to Principal '*' is publicly writable; any internet actor can inject events and potentially trigger compute consumers.
events:PutPermission allows a principal to rewrite a custom bus resource policy, injecting cross-account trust or public access.
A repository resource policy grants ecr:PutImage to a principal in another AWS account, creating a cross-account supply-chain push trust.
An external principal granted ecr:PutImage via the repository's resource policy can push images (cross-account supply-chain attack).
A principal with ecr:DeleteRepositoryPolicy can delete the repository resource policy, removing all access controls and cross-account restrictions - policy-mutation escalation.
A registry-level replication policy allows an external account's repository to replicate images into the victim's registry, enabling cross-account supply-chain poisoning via the replication mechanism.
A principal with ecr:SetRepositoryPolicy can rewrite the repository resource policy to grant itself or any other principal push or pull access - policy-mutation escalation prerequisite.
An EFS file system policy granting ClientMount to a principal from another AWS account creates a cross-account NFS data path.
A principal with elasticfilesystem:PutFileSystemPolicy can self-grant ClientMount and read all file data on the EFS file system.
A principal with elasticfilesystem:PutFileSystemPolicy can self-grant ClientWrite and write all file data on the EFS file system.
A backup's resource policy (via fsx:GetResourcePolicy) grants fsx:CopyBackup to a principal in a different AWS account, establishing a cross-account trust on the backup resource.
An identity with fsx:PutResourcePolicy on an FSx backup can rewrite the backup's resource policy to grant an external account fsx:CopyBackup access, staging a cross-account backup exfil without touching the live file system.
A Kinesis stream resource policy granting kinesis:PutRecord(s) to a principal in another account is cross-account publish trust, enabling that external principal to trigger the stream's Lambda consumer.
A Kinesis stream resource policy granting read actions (GetRecords/GetShardIterator/SubscribeToShard) to a foreign account enables that account to read the stream's records, supporting data exfiltration.
An external principal permitted by the key policy/grant can use the key cross-account.
An LF admin (or GRANT OPTION holder) granting Lake Formation SELECT / INSERT / DATA_LOCATION_ACCESS to a principal ARN in a foreign AWS account creates cross- account data-lake trust: the external principal can query this account's governed data via their own analytics services.
An MSK cluster resource-based policy granting kafka-cluster:WriteData or ReadData to a principal in another account is cross-account publish/consume trust; feeds messaging-chains rule 4 and can-control's CanEnterAccount derivation.
kafka:PutClusterPolicy allows writing the MSK cluster resource-based policy, enabling the attacker to grant kafka-cluster:WriteData (or ReadData) to arbitrary principals including cross-account ones.
Domain access policy grants es:ESHttp* to a principal in a foreign AWS account, enabling cross-account data access without a role assumption.
A RAM share whose principal is the organization root (o-*) exposes the shared resource to every current and future member account in the organization - ExposedToTenant.
A shared subnet collapses the inter-account network boundary: consumer workloads launched into the shared subnet are on-link with owner-account resources, yielding on-subnet network reachability.
A shared Transit Gateway enables the consumer VPC to reach owner-account resources attached to the TGW, derived from the CrossAccountTrust fact and confirmed TGW attachments.
A principal in account B provisioning a product from a portfolio shared by account A (servicecatalog:ProvisionProduct) causes resources to be deployed in account A as the account-A launch role. The receiving-account principal effectively gains a foothold in account A via the launch role's permissions.
sns:SetTopicAttributes (Policy attribute) or sns:AddPermission rewrites or extends the SNS topic access policy, enabling self-grant of Publish/Subscribe or cross-account trust.
An SNS topic without a DataProtectionPolicy may carry messages embedding secrets; any subscriber can read them (POTENTIAL - content heuristic, not confirmed).
An SNS topic access policy granting sns:Publish to Principal '*' is internet-accessible - anyone can publish and trigger all subscribers.
A queue resource policy granting sqs:SendMessage to a principal in another account is cross-account publish trust; fed by messaging-chains rule 4 to derive CanEnterAccount.
sqs:SetQueueAttributes allows rewriting the queue resource policy (Policy attribute), enabling self-grant of sqs:SendMessage and the downstream trigger chain.