rage.fail

CanCreate

Source can create new resources of a type within a scope.

resource_control CONTROL nature: explicit walkable weight 2

Identity ── CanCreate ──▸ AdministrativeBoundary, *

Source types

Identity

Target types

AdministrativeBoundary*

States

ACTIVE CONDITIONAL POTENTIAL BLOCKED UNKNOWN

Derivation

nature	explicit

Rules that emit CanCreate 7

aws-cloudfront-create-distribution-config

A principal with cloudfront:CreateDistribution can create new distributions pointing at any origin (S3 bucket, ALB, API Gateway, custom endpoint). If an S3 bucket has an overly-broad OAC policy grant (missing aws:SourceArn condition), the attacker can create a distribution to expose its contents publicly.

awsderived

aws-elb-create-internet-facing

A principal with CreateLoadBalancer + CreateListener + CreateTargetGroup + RegisterTargets + EC2 read/write perms can create a new internet-facing ALB or NLB, exposing any registered backend to the public internet. Emit CanCreate(Identity -> LoadBalancer) as a POTENTIAL escalation premise; ExposedToInternet fires on the resulting LB.

awsderived

aws-sso-create-user

A principal with identitystore:CreateUser can inject a phantom user into the Identity Store. The phantom user has no privilege until assigned via CreateGroupMembership (rule 4) or CreateAccountAssignment (rule 1); this rule documents the capability to create, not the escalation.

awsderived

gcp-batch-can-create-job

gcpderived

aws-lf-register-resource-permission

awsexplicit

aws-memorydb-can-create-acl-user

awsexplicit

aws-ram-create-resource-share

awsexplicit