CanAttachIdentity
Source can attach/replace the identity a compute resource runs as, including updating a workflow/orchestration service's execution identity. Also applies to data resources (caches, databases) where an identity is used for encryption or service-to-service auth. Produced both by explicit normalization (attach/assign permissions on target resources) and by derived rules (e.g., CanPassIdentity + CanModifyConfiguration on target).
Identity
── CanAttachIdentity ──▸
Compute, Messaging, AnalyticsService, RelationalDatabase, LoadBalancer, Data
Source types
IdentityTarget types
States
ACTIVE
CONDITIONAL
POTENTIAL
BLOCKED
UNKNOWN
Derivation
| nature | both |
|---|
Per-cloud
| cloud | permissions / triggers | note |
|---|---|---|
| aws |
iam:PassRole + ec2:AssociateIamInstanceProfile ecs:RegisterTaskDefinition
|
|
| gcp |
compute.instances.setServiceAccount + actAs workflows.workflows.update + iam.serviceAccounts.actAs
|
|
| azure |
assign user-assigned MI to resource
|
Rules that emit CanAttachIdentity 37
UpdateApp + iam:PassRole can replace an Amplify App's iamServiceRoleArn, changing the build execution identity.
awsderived
UpdateBranch + iam:PassRole can replace an Amplify Branch's computeRoleArn, changing the SSR request-serving identity.
awsderived
Update/CreateService + PassRole can attach/replace the identity the service runs as.
awsderived
Update an ASG / swap its launch template or config to launch instances as a more-privileged instance-profile role.
awsderived
Set or replace the instance profile / service role on an environment via option settings.
awsderived
Attach an instance profile (role) to an instance the attacker can run code on.
awsderived
Swap the role an existing instance runs as.
awsderived
Change an existing Glue job's RoleArn to a passed privileged role via glue:UpdateJob + iam:PassRole; the next run executes as the new role.
awsderived
awsderived
Swap an existing function's execution role via UpdateFunctionConfiguration.
awsderived
azurederived
managedClusters/agentPools/write + assign on a target MI allows swapping the kubelet MI, binding all nodes to a more-privileged identity.
azurederived
azurederived
Attach a user-assigned managed identity to an Automation Account (Azure PassRole analog); subsequent runbooks execute as that MI.
azurederived
azurederived
azurederived
Attach/swap a user-assigned MI on a Databricks Access Connector, giving all workspace clusters access to that MI via IMDS.
azurederived
Attach a user-assigned managed identity to a Data Factory (factories/write + assign/action on the MI), binding a higher-privilege identity to the factory's pipeline runs.
azurederived
DevOps 'Manage service endpoints' permission lets a principal bind a different - potentially more privileged - service connection to a pipeline, changing its execution identity.
azurederived
azurederived
An attacker who can write an Application Gateway and pass a user-assigned MI can swap the gateway's identity, gaining that MI's Key Vault (and potentially broader) permissions.
azurederived
Attach a user-assigned managed identity to a Logic App (assign/action + workflows/write or sites/write).
azurederived
Attach a user-assigned MI to an AML compute cluster/instance - future jobs run as the new MI.
azurederived
redis/write permission allows attaching/replacing the managed identity used for CMK (data-at-rest encryption).
azurederived
azurederived
Attach a user-assigned MI to the workspace (workspaces/write + assign/action); all Spark jobs and pipelines then run as both the system-assigned MI and the newly attached user-assigned MI.
azurederived
azurederived
assign/action on an MI + VMSS write => can attach/replace the identity the fleet runs as.
azurederived
clouddeploy.targets.update + actAs(execution SA) re-points all future Cloud Deploy job runs on this target to execute as the chosen SA.
gcpderived
Set/replace the runtime SA on a Cloud Run resource (create or update) while holding actAs on that SA.
gcpderived
Update the serviceAccountEmail field of an HTTP job's oidcToken/oauthToken to swap the execution identity (jobs.update + actAs on new SA).
gcpderived
composer.environments.update + iam.serviceAccounts.actAs on a new SA: swap the Composer environment's runtime SA; future DAG tasks run as the new SA.
gcpderived
clusters.update + actAs on the new SA attaches (swaps) the cluster's runtime SA - all future jobs run as the new SA.
gcpderived
gcpderived
gcpderived
Update a Workbench instance's service account (notebooks.instances.update + actAs on new SA) so future code runs as the new SA.
gcpderived
Update the serviceAccount field to swap the runtime SA of an existing workflow.
gcpderived