CanGrantPermission

CreateAccessEntry + AssociateAccessPolicy with AmazonEKSClusterAdminPolicy maps an IAM principal to Kubernetes cluster-admin (system:masters) RBAC. The principal can then exec into any pod and execute as its IAM role.

Kubernetes write access to the aws-auth ConfigMap in kube-system (obtained after gaining any cluster access) allows adding any IAM ARN to the mapRoles/mapUsers entries with groups: [system:masters], granting cluster-admin to arbitrary IAM principals. This is the legacy (CONFIG_MAP authMode) escalation vector.

lakeformation:GrantPermissions lets a principal grant LF data-lake permissions (SELECT / INSERT / DATA_LOCATION_ACCESS / etc.) to ANY principal, including themselves. This sub-rule captures the self-grant case (principal -> principal), the privilege escalation primitive in Lake Formation.

lakeformation:PutDataLakeSettings lets a principal add themselves to the Lake Formation DataLakeAdmins list, after which ALL LF permission checks are bypassed for that principal - they can grant any data permission to any principal, read any governed table, and modify any registered location. Emits CanGrantPermission (nature:both) to feed into can-control linchpin for escalation roll-up.

opsworks:SetPermission lets a principal grant any OpsWorks user admin or deploy rights on a stack, enabling self-escalation to deployment capability.

quicksight:RegisterUser + quicksight:UpdateUser (role=ADMIN) lets an attacker promote themselves or others to QuickSight admin, gaining read access to all datasets, dashboards, and data source configurations.

A principal with sso:CreateAccountAssignment can assign any user or group to any permission set (including AdministratorAccess) in any member account, granting org-wide privilege - the SSO equivalent of iam:AttachUserPolicy at org scope.

A principal that can attach a policy to a permission set (via sso:PutInlinePolicyToPermissionSet or sso:AttachManagedPolicyToPermissionSet) widens the effective permissions of every current assignee of that permission set across all assigned accounts.

A principal with roleAssignments/write or Owner role can grant the Azure Kubernetes Service RBAC Cluster Admin role to any principal.

A deployment at subscription/MG scope whose deploying principal already holds roleAssignments/write can create role assignments (including Owner) for any identity via the template.

A blueprint definition containing a role-assignment artifact grants RBAC at the deployment scope when the assignment executes - the assigner effectively controls who gets RBAC at that scope.

MANAGE privilege on a Unity Catalog object (catalog/schema/table/storage credential) allows granting access to other principals, including self.

MANAGE ACL on a Databricks secret scope allows granting READ/WRITE/MANAGE access to other principals and managing ACLs.

Contributor/Key Vault Contributor self-adds an access policy to gain data-plane access (access-policy model only).

Owner/User Access Admin self-assigns a Key Vault data-plane role (RBAC model).

A managing-tenant principal delegated User Access Administrator (with allowDelegatedRoleAssignments: true) can assign roles in the customer subscription - subscription-scoped CanGrantPermission.

Owner / User Access Administrator on the AML workspace or compute scope can grant AML roles to any principal, including itself.

Any Managed HSM local role that carries roleAssignments/write can assign any local role, including to itself.

Ability to assign RBAC at a management group scope (Owner / User Access Administrator) is a boundary-scoped self-grant over the whole subtree.

A Microsoft Entra Global Administrator can call elevateAccess to gain User Access Administrator at root scope (/), controlling the root management group and thus every subscription in the tenant.

A service principal holding RoleManagement.ReadWrite.Directory can assign any Entra directory role (including Global Administrator) to any principal, achieving tenant takeover - the app-permission equivalent of holding Privileged Role Administrator.

A principal holding the Purview Collection Admin role can assign Purview RBAC roles (including Data Curator, Data Source Administrator, Collection Admin) to any other principal or to themselves via the Purview role assignment API. This enables privilege escalation within the Purview account: a Collection Admin can self-assign additional roles, elevate another compromised principal, or revoke access from other admins.

An identity with ARM Contributor or Owner permission on a Microsoft.Purview/accounts resource holds the implicit Root Collection Admin role in Purview (assigned at account creation). This cross-plane escalation enables data-plane privilege escalation: the ARM admin can manage Purview role assignments, self-assign Data Curator, and control access within the data-plane.

User Access Administrator (or RBAC Administrator) at a scope can assign itself Owner - role-assignment privesc.

workspaces/administrators/write allows setting the AAD administrator on the workspace, effectively granting that principal Synapse Administrator-equivalent data-plane access.

bigtable.tables.setIamPolicy lets a principal grant any role on the table to any principal (including itself). Self-granting roles/bigtable.user (includes bigtable.tables.readRows + bigtable.tables.mutateRows) yields full data-plane read/write access scoped to that table without project-level IAM change.

bigtable.instances.setIamPolicy lets a principal grant instance-scope roles to any principal (including itself). Self-granting roles/bigtable.admin on the instance yields full control over all tables, clusters, and backups within the instance without project-level IAM change. Instance-scope setIamPolicy is a higher-value escalation than table-scope because it affects all tables.

bigtable.authorizedViews.setIamPolicy lets a principal grant view-scope roles to any principal (including itself). Self-granting bigtable.authorizedViews.readRows or bigtable.authorizedViews.mutateRows on a view yields data access scoped to that view's row/column subset without modifying table-level or instance-level IAM. View-scope setIamPolicy is a distinct, view-only escalation primitive.

caPools.setIamPolicy lets a caller bind itself certificateRequester and then issue.

Workspace super-admin can grant any GCP IAM role to any principal in the linked GCP organization, equivalent to resourcemanager.organizations.setIamPolicy.

storage.buckets.setIamPolicy on the Composer environment GCS bucket lets the principal grant storage.objects.create (dags/ write access) to itself or others, enabling the DAG-write code-execution path.

The Google APIs service agent's effective permissions include *.setIamPolicy on resources it manages when it holds roles/editor (GCS, SA, Pub/Sub, etc.). A DM config can instruct the SA to call setIamPolicy, granting the deployer any role on those resources.

The Google APIs service agent's effective permissions include resourcemanager.projects.setIamPolicy ONLY when it holds roles/owner. A DM config can instruct the SA to call setIamPolicy at project scope, granting the deployer project-level roles.

datastore.databases.setIamPolicy lets a principal grant itself roles/datastore.owner or roles/datastore.viewer on the database, then read or administer all documents.

A principal with CanModifyPolicy on a bucket's IAM policy can grant itself roles/storage.objectViewer or roles/storage.admin and read or administer its objects.

K8s RBAC clusterrolebindings/create (or wildcard *) verb lets a principal bind cluster-admin to any subject, effectively granting itself full cluster control - the k8s privilege escalation via RBAC.

cryptoKeys/keyRings.setIamPolicy lets a key manager bind itself a crypto role.

secrets.setIamPolicy lets a caller bind itself secretAccessor and then read the payload.

spanner.databases.setIamPolicy lets a principal grant any role on a specific database to any principal, including itself - self-granting roles/spanner.databaseAdmin yields full data-plane access plus further IAM mutation rights on that database.

spanner.instances.setIamPolicy lets a principal grant any instance-level role to any principal, including itself. This affects ALL databases within the instance - a broader blast radius than database-scope setIamPolicy.

opsworks:SetPermission grants a principal the ability to assign deploy/admin/SSH rights to any OpsWorks user on a stack.

bigquery.datasets.setIamPolicy lets a principal grant data access to any principal (including itself) for all tables in the dataset.