CanExecuteAs
Attacker-controlled code can run with the target identity's privileges. Canonical derived escalation edge.
Identity
── CanExecuteAs ──▸
Identity
Source types
IdentityTarget types
IdentityStates
ACTIVE
CONDITIONAL
POTENTIAL
BLOCKED
UNKNOWN
Derivation
| nature | derived |
|---|
Rules that emit CanExecuteAs 106
Invoking an API Gateway API whose integration ExecutesAs a credentials role runs the integration as that role, yielding CanExecuteAs.
awsderived
Changing an integration's credentials field to a more-privileged role (apigateway:PATCH + iam:PassRole) then invoking yields execution as the new role.
awsderived
Modify code/image of a service that already has an instance role -> run as that role.
awsderived
Retarget InstanceRoleArn to a more-privileged role via UpdateService + PassRole.
awsderived
Supply-chain: poison the auto-deployed source -> run as the instance role.
awsderived
Modify the $Latest/$Default launch-template version an ASG uses; the ASG service-linked role launches with the chosen instance profile even without caller iam:PassRole.
awsderived
Roll-up: create/update/point an ASG at an instance profile and get code running as its role.
awsderived
Register a job definition with attacker code + a passed privileged jobRole, then submit it.
awsderived
Submit an existing definition (with command override) whose bound jobRole is privileged - no PassRole needed.
awsderived
Swap a Bedrock Agent's execution role via UpdateAgent+PassRole to execute the orchestration loop as an attacker-chosen role.
awsderived
Swap a Bedrock Knowledge Base's service role via UpdateKnowledgeBase+PassRole to access data sources as an attacker-chosen role.
awsderived
Create a new CodeBuild project bound to a passable privileged role and start a build to execute as that role.
awsderived
UpdateProject + PassRole swaps the service role of an existing project; the next build runs as the new (attacker-chosen) role.
awsderived
Trigger a deployment to execute orchestration-plane actions as the deployment group's service role - requires a run path.
awsderived
StartPipelineExecution over a pipeline whose current definition already runs attacker-influenced code (poisoned artifact, malicious source commit, unpinned dependency) yields execution as the pipeline's service/action role; cicd-chains rule 2 is the canonical collapse (CONDITIONAL).
awsderived
Create a pipeline with a ShellCommandActivity injecting attacker commands, pass a privileged role as resourceRole, and activate: the EC2 resource runs attacker code as that role. The classic Data Pipeline PassRole RCE.
awsderived
Inject shell commands into an existing pipeline definition and activate it to execute as the resourceRole already bound to that pipeline - no iam:PassRole needed.
awsderived
Run code on an instance that ExecutesAs a role -> execute as that role.
awsderived
Register + run an attacker container as a passable task role.
awsderived
Redeploy an existing service onto an attacker task definition revision.
awsderived
ECS Exec into a task -> execute as its task role.
awsderived
Exec into a running pod (via cluster-admin or direct pods/exec RBAC) inherits the pod's mounted IRSA or Pod Identity token, executing as the pod's IAM role. Cites container-chains cluster-rbac-exec; dedupes on (CanExecuteAs, principal, role).
awsderived
Submit a step to a running EMR cluster via AddJobFlowSteps; the step executes as the cluster's instance profile role without iam:PassRole.
awsderived
Create a new EMR cluster with a privileged JobFlowRole via RunJobFlow + iam:PassRole; arbitrary bootstrap/step code executes as that role.
awsderived
Submit an EMR Serverless job run with attacker-controlled application code and a passed privileged executionRole via emr-serverless:StartJobRun + iam:PassRole.
awsderived
Submit an EMR on EKS job run with attacker-controlled application code and a passed privileged execution role via emr-containers:StartJobRun + iam:PassRole.
awsderived
Write to EMR Studio workspace S3 backing to inject code into notebooks; notebook execution runs as Studio service role or attached cluster's JobFlowRole.
awsderived
PassRole + ability to create/run a compute resource that accepts the role.
awsderived
Create a new malicious component version, update the pipeline to reference it, and trigger a build to execute shell commands as the build instance's IAM role.
awsderived
Update an image pipeline to reference an attacker-controlled recipe (which may include malicious components or an S3-overwritable component URI), then trigger a build to execute as the build instance role.
awsderived
Replace the infrastructure configuration's instance profile with a higher-privilege IAM role (UpdateInfrastructureConfiguration + iam:PassRole), then trigger a build to execute as that role.
awsderived
Trigger an Image Builder pipeline whose current definition already executes attacker-influenced code (e.g., an S3-overwritable component URI or an already-tampered component version), executing as the build instance role.
awsderived
Replace function code, then run it, to execute as the function's role.
awsderived
Inject code via env/layer/handler config change, then run, as the role.
awsderived
Arbitrary container deployment runs as the Lightsail-managed service execution context.
awsderived
OS access to a Lightsail instance -> read IMDS -> act as the associated role.
awsderived
An attacker who can modify QuickSight's configuration (UpdateAccountSettings) and pass an IAM role to it gains execution as that role for all data queries.
awsderived
Pass a privileged IAM role to a Redshift cluster (iam:PassRole + ModifyClusterIamRoles), then submit a COPY/UNLOAD/UDF query that uses that role's AWS permissions. Covers both already-attached and attach-new-then-execute paths.
awsderived
CreatePresignedNotebookInstanceUrl opens a browser-based Jupyter shell on a running notebook, giving the caller immediate code execution as the notebook's execution role - no iam:PassRole required.
awsderived
CreatePresignedDomainUrl opens a Studio session as the specified user profile's execution role - no iam:PassRole required.
awsderived
servicecatalog:ProvisionProduct or UpdateProvisionedProduct on a product bound to a LaunchRole constraint executes the product's CFN template as the launch role, even when the provisioning principal holds no CloudFormation or IAM permissions of their own. Any parameter-driven custom resource or UserData the user controls runs as the launch role.
awsderived
servicecatalog:ExecuteProvisionedProductServiceAction on an associated SSM Automation service action executes the automation document as the service action's automation role. A principal who can trigger a provisioned product and execute its service actions runs arbitrary SSM Automation as the automation role.
awsderived
Directly invoke a state machine (states:StartExecution) with an attacker-supplied input payload to execute as the machine's execution role.
awsderived
Modify a state machine's ASL definition (states:UpdateStateMachine), then trigger an execution to run arbitrary AWS SDK Task states as the execution role.
awsderived
exec in a container + its group runs as an MI => execute as that MI (via IMDS/env token).
azurederived
write (recreate) a container group that already runs as an MI => execute as that MI.
azurederived
Cluster-admin kubeconfig -> exec any pod -> execute as every pod workload identity (cluster-wide summary edge; per-pod edges from container-chains cluster-rbac-exec).
azurederived
runCommand grants cluster-wide kubectl exec; any pod's workload identity is reachable by exec-ing into the pod (container-chains cluster-rbac-exec).
azurederived
Node-level code execution (privileged pod, hostPID, DaemonSet exec) reaches the node IMDS and mints a token for the node system-assigned / kubelet MI.
azurederived
Code/config modification on a site + the site runs as an MI => execute as that MI (via the MSI token endpoint).
azurederived
Config modification (startup command / app settings) on a site + the site runs as an MI => execute as that MI.
azurederived
Attach a privileged user-assigned MI to a site the attacker can already run code on, then execute as that MI. This is an existing-site chain (CanExecuteAs), NOT a create-new-workload chain.
azurederived
Publishing profile creds -> Kudu ZipDeploy/command API -> code in the worker -> execute as the site MI.
azurederived
Modify a pool startTask/config + the pool runs as an MI => execute as that MI (via IMDS).
azurederived
Submit a data-plane task + the pool runs as an MI => execute as that MI (via IMDS).
azurederived
Shared key -> data-plane task submit on an identity-bearing pool => execute as the pool MI.
azurederived
Control-plane image/command replacement + the app runs as an MI => execute as that MI (via the identity endpoint).
azurederived
Exec into a running replica + the app runs as an MI => execute as that MI (read the identity endpoint from the shell).
azurederived
Executing code in a custom-container session that binds a reachable MI => execute as that MI (read the identity endpoint from the session).
azurederived
Code modification on a Function app + the app runs as an MI => execute as that MI (via the identity endpoint).
azurederived
Config modification (run-from-package / image / startup) + ExecutesAs => execute as the MI.
azurederived
Master/host key -> admin runtime API to overwrite+run code as the MI.
azurederived
Publishing (SCM/Kudu/FTP) credentials -> push code -> execute as the MI.
azurederived
Deploy/upgrade an SF app with attacker code + the app runs as an MI => execute as that MI via the localhost token service.
azurederived
Admin client cert -> provision app + the app runs as an MI => execute as that MI.
azurederived
Synapse Compute Operator submits a Spark batch job via Livy API (CanExecuteCommand) + Spark pool runs as workspace MI (ExecutesAs) => execute attacker code as the workspace MI.
azurederived
Upload malicious library to a Spark pool (CanModifyCode) + the pool runs as the workspace MI (ExecutesAs) => execute code as the workspace MI. Cites can-execute-as.yaml execute-as-via-code-modify.
azurederived
Publish a pipeline with attacker code (CanModifyCode on workspace) + trigger it (CanTrigger) + workspace ExecutesAs MI => execute as workspace MI. Cites cicd-chains.yaml cicd-modify-buildspec-executes-as and can-execute-as.yaml.
azurederived
Retrieve IR auth key (CanReadSecret) + register a self-hosted IR node the attacker controls -> that node executes pipeline activities as the workspace MI. No generic linchpin covers this path; rule is Synapse-specific.
azurederived
Command/code execution on a VM + the VM runs as an MI => execute as that MI (via IMDS).
azurederived
Attach a privileged user-assigned MI to an existing VM the caller can run code on, then execute as that MI via IMDS.
azurederived
Modify the fleet's code/config + it executes as an MI => execute as that MI.
azurederived
Run-command on an instance that executes as an MI => execute as that MI.
azurederived
Attach a chosen MI to the fleet + drive instance refresh => execute as the attached MI.
azurederived
Modify code of a compute resource that runs as a privileged identity.
derived
Change the execution identity binding of a compute resource to a chosen privileged identity.
derived
Create a new workload and attach a privileged identity to it.
derived
Run OS commands on a host that already runs as a privileged identity.
derived
Modify the buildspec/pipeline/runbook/template a runner executes, then run it, to execute as the runner's service identity.
derived
Trigger/start a runner whose current definition already runs attacker-influenced code, executing as the runner's identity.
derived
A workload poisoned via a registry image push runs as its identity, so the pusher executes as that identity.
derived
Exec into a pod (cluster RBAC / credential / run-command) inherits the pod's mounted ServiceAccount/IRSA/Workload-Identity token, executing as that identity.
derived
Deploy a new App Engine version (attacker code) that executes as the runtime SA.
gcpderived
Route App Engine traffic to a version that runs as a privileged SA (no invoke perm needed).
gcpderived
Deploy a version with a custom, more-privileged runtime SA via actAs.
gcpderived
Interactive debug/SSH on a Flexible instance yields code exec as the instance runtime SA.
gcpderived
Create a job with an attacker runnable bound to an actAs-able SA; ExecutesAs completes it. ACTIVE on create (no invoke/trigger).
gcpderived
Create a job WITHOUT specifying a runtime SA -> runs as the Compute Engine default SA (usually roles/editor).
gcpderived
Create a Cloud Deploy release with attacker-controlled Skaffold config + actAs(render SA) → execute arbitrary code as the render SA inside the Cloud Build worker.
gcpderived
Promote a Cloud Deploy release (rollouts.create) + actAs(deploy SA) → deploy Cloud Build worker executes as the deploy SA, which has runtime control over the target (GKE/Cloud Run).
gcpderived
Re-pointing a target's executionConfigs SA (targets.update + actAs) then promoting a rollout yields code execution as the newly attached SA.
gcpderived
Modify code/config of an existing Cloud Run resource; it runs as its existing runtime SA.
gcpderived
Create a new Cloud Run resource bound to a chosen SA (actAs) and invoke/run it.
gcpderived
A principal with deploymentmanager.deployments.create submits an attacker-controlled config; DM actuates it as the Google APIs service agent, executing code (resource creation, setIamPolicy) as that SA's identity.
gcpderived
A principal with deploymentmanager.deployments.update replaces an existing deployment's config; DM re-executes as the cloudservices SA.
gcpderived
A principal with deploymentmanager.typeProviders.create registers a custom type provider backed by an attacker-controlled endpoint; a DM deployment using that type causes DM to call the endpoint as the cloudservices SA, yielding execution as that SA. Uses CanModifyConfiguration path (typeProviders.create emits CanModifyConfiguration on the Deployment).
gcpderived
Create a new Eventarc trigger binding an event source to a destination consumer, then publish an event (or wait for a natural event) to run the consumer as its runtime SA. Provides the Eventarc-specific framing of messaging-chains rule 2.
gcpderived
Update an existing Eventarc trigger's destination to point at attacker-controlled or higher-privilege compute, then wait for a natural event to fire, gaining execution as the new destination's runtime SA.
gcpderived
Any code-exec/rebind/create primitive on a SA-bearing instance -> execute as its SA.
gcpderived
Modify function source + (invoke/call OR existing trigger) + ExecutesAs.
gcpderived
Config change (env/secret/entry point) that injects code + run + ExecutesAs.
gcpderived
Update the runtime SA of an existing function to a more-privileged actAs-able SA.
gcpderived
actAs + ability to create a resource that runs as the SA.
gcpderived
Re-pointing the queue's OIDC/OAuth token SA (cloudtasks.queues.update + iam.serviceAccounts.actAs) causes every future dispatch to carry a token for the chosen SA - an attacker controlling the consumer endpoint captures the token and exercises the SA's privileges.
gcpderived
Triggering an event-driven consumer that executes as an identity runs the attacker-influenced payload as that identity (generic messaging case; CI/CD runners are cicd-chains').
derived
Creating a schedule/rule that invokes a target as a passed execution identity is persistence and yields execution as that identity.
derived