Derivation rules

An exportable ACM certificate exposes its private key to any principal that can export it.

An exported ACM private key authenticates as the certificate's DNS/TLS server identity.

An AppFlow connector profile's stored credential (OAuth token / API key) authenticates to the external SaaS system - reading the Secrets Manager secret yields a usable credential for that SaaS identity.

CodeBuild project env vars of type SECRETS_MANAGER or PARAMETER_STORE reference secret material injected into every build's environment.

Explicit extraction: pipeline definition contains plaintext credential material in activity fields.

DocumentDB cluster stores its master MongoDB user password in a Secrets Manager secret when ManageMasterUserPassword is enabled.

A principal that can read the DocumentDB master-password secret from Secrets Manager can authenticate to the cluster as the master MongoDB user, gaining full data-plane access (read/write/drop) across all databases on the cluster.

A snapshot of a volume from an instance with an instance profile (IAM role) may contain credentials, SSH keys, or other secrets on the disk. This edge is ONLY emitted when forensic evidence confirms credential material on the disk image, not from structural probability alone. The preconditions are: (1) the volume was attached to an instance with an ExecutesAs role, (2) a snapshot exists of that volume, and (3) forensic scanning or manual inspection has detected credential patterns on the disk.

Reading snapshot data (CanReadData) that contains secrets (ContainsSecret) lets the principal extract and authenticate as the identity those secrets belong to - shorthand for the CanReadData → ContainsSecret → CredentialsFor chain into the CanReadSecret pivot. This rule feeds credential-chains.yaml: read-secret-yields-identity.

A Glue Connection stores JDBC/Kafka/OAuth credentials; glue:GetConnection returns the plaintext PASSWORD, exposing the database credential.

A KMS-decryptable secret exposes the credential of the identity it belongs to once the KMS gate is satisfied.

Decrypt on a CMK completes the key_permission gate for a secret encrypted under it.

Reading the Secrets Manager secret that holds Amazon MQ broker credentials gives the principal the ability to publish to the broker queue (CONDITIONAL on network reachability to the broker endpoint), which messaging-chains then rolls up to CanTrigger on the Lambda consumer.

A principal with es:UpdateDomainConfig on a FGAC domain with internal user database can reset and effectively read the master-user password.

FGAC domain with internal user database exposes the master-user password to whoever can call es:UpdateDomainConfig.

OpsWorks App secure environment variables are credentials accessible to all deployment code on the stack.

opsworks:DescribeStackProvisioningParameters exposes agent registration keys and other provisioning secrets.

Reading the RDS-managed master password secret (secretsmanager:GetSecretValue on MasterUserSecretArn) yields superuser DB access - the master credential authenticates as the DB admin user.

A principal with secretsmanager:GetSecretValue on the Redshift ManagedAdminPassword secret can retrieve the plaintext admin DB password and connect as superuser, reading all warehouse data.

A principal that can read a bucket's data (CanReadData) and the bucket contains secrets (ContainsSecret) can read those secrets via s3:GetObject.

Gates the existing explicit CanReadSecret edge on kms:Decrypt (CONDITIONAL(key_permission)) when the secret is CMK-encrypted.

Reading a secret that is credentials for a strictly-more-privileged identity is escalation.

Cross-account read of a secret that is credentials for a local identity is a foothold in this account.

Gates the existing explicit cross-account CanReadSecret edge on the secret resource policy AND the CMK key policy.

Sets the existing explicit CanReadSecret edge to ACTIVE when the secret is wrapped by the AWS-managed key (transparent same-account decrypt).

PutResourcePolicy self-grants GetSecretValue on a secret that is credentials for a more-privileged identity - escalation.

PutSecretValue/UpdateSecret plants an attacker-controlled credential in the secret that any consumer refetches and trusts.

A Step Functions activity task state embeds the current execution data context as the task payload returned by GetActivityTask; if upstream states processed sensitive data, the payload may contain secrets.

An SNS topic without a DataProtectionPolicy may carry messages embedding secrets; any subscriber can read them (POTENTIAL - content heuristic, not confirmed).

A consumer reads a RAM-shared SecureString whose creds grant the owning account.

Reading a SecureString that holds creds for a more-privileged identity is escalation.

A SecureString parameter exposes credential material to any reader.

A SecureString parameter's value authenticates as the target identity/service.

Overwrite a parameter's value (ssm:PutParameter Overwrite) to poison consumers.

Reading data from a Timestream table that contains secret material yields the ability to read those secrets, enabling credential-chain pivots.

Obtain a short-lived ADF data-plane access token (getDataPlaneAccess/action) scoped to factory Author/Monitor/DataAccess operations.

Read an ADF linked service definition that contains inline connection string, storage key, SP client secret, or password.

Read an ADF pipeline definition containing inline SAS URLs, API keys, or connection strings in activity url/body parameters.

A Self-Hosted IR node VM stores encrypted linked service credentials in its local credential store; OS-level access to the node decrypts them.

An AML datastore configured with accountKey/SAS/servicePrincipal credential exposes that credential to principals with listsecrets.