CanModifyCode
Source can change the executable content a compute resource runs, including orchestration workflows and logic apps that are executable definitions. Produced by explicit normalization (code-update permissions) and by derived rules (supply-chain code-injection paths).
Identity
── CanModifyCode ──▸
Compute, ContainerRegistry, ArtifactRepository, KubernetesWorkload, Messaging, AnalyticsService, AutomationService
Source types
IdentityTarget types
States
ACTIVE
CONDITIONAL
POTENTIAL
BLOCKED
UNKNOWN
Derivation
| nature | both |
|---|
Per-cloud
| cloud | permissions / triggers | note |
|---|---|---|
| aws |
lambda:UpdateFunctionCode ecr:PutImage
|
|
| gcp |
cloudfunctions.functions.update run.services.update artifactregistry.repositories.uploadArtifacts workflows.workflows.update
|
|
| azure |
Function app deploy / SCM write AcrPush
|
Rules that emit CanModifyCode 149
amplify:UpdateApp with buildSpec field rewrites the app-level build commands for all branches.
awsderived
amplify:UpdateBranch with buildSpec field rewrites build commands for a specific branch.
awsderived
UpdateService can rewrite the code (build/start command) or image an App Runner service runs.
awsderived
awsderived
SubmitJob with container command/environment overrides runs attacker-chosen code against an existing definition's image without registering a new revision.
awsderived
Register a new application version (S3 source bundle) and deploy it to an environment.
awsderived
Redirect a Bedrock Agent action group's backing Lambda to an attacker-controlled Lambda, injecting code into the agent's execution path.
awsderived
cloudformation:UpdateStack lets a caller replace the template a stack executes, making the stack run attacker-chosen resource API calls as its service role.
awsderived
cloudformation:CreateChangeSet with attacker template + cloudformation:ExecuteChangeSet applies the attacker's template to the stack, running as the service role.
awsderived
Write access to the S3 object that a stack's TemplateURL references: the next stack update will load and execute the attacker's template as the service role.
awsderived
cloudformation:ExecuteChangeSet alone (approver role, no CreateChangeSet): can apply an attacker-authored pending change set if one already exists - CONDITIONAL on attacker-authored change set being present.
awsderived
A principal with cloudfront:UpdateFunction and cloudfront:PublishFunction can modify CloudFront Functions code. While CloudFront Functions cannot call AWS APIs (no IAM escalation), modified code can forge trusted headers to origins, enabling application-layer bypass attacks.
awsderived
Publishing a package version to a CodeArtifact repository injects code into every consumer that installs the package - supply-chain CanModifyCode.
awsderived
Publishing to an upstream repository propagates CanModifyCode to every downstream repository in the upstream chain whose consumers resolve packages through it.
awsderived
Copying a package version into a CodeArtifact repository via CopyPackageVersions injects code into every consumer of that repository - supply-chain CanModifyCode.
awsderived
codebuild:StartBuild allows supplying buildspecOverride, running arbitrary commands as the project's service role.
awsderived
codebuild:StartBuildBatch allows supplying buildspecOverride for the primary build in the batch, running arbitrary commands as the project's service role.
awsderived
codebuild:UpdateProject rewrites the project's stored buildspec, affecting all future builds.
awsderived
Writing to the project's source repository/bucket on the tracked branch injects code into future builds when the buildspec is stored in-source.
awsderived
GitPush to the branch a downstream CodeBuild project or CodePipeline stage tracks gives the attacker code-injection into that runner's execution.
awsderived
PutFile to the branch a downstream runner tracks injects a single-file change (e.g. buildspec.yml) into the pipeline's build.
awsderived
Overriding PR approval rules and merging an attacker-authored PR branch into the tracked branch bypasses the branch-protection gate and injects code into the pipeline.
awsderived
A cross-account GitPush grant in the repository resource policy lets an external principal inject code into pipelines in the repository-owning account.
awsderived
Write access to the pipeline's artifact store S3 bucket/prefix lets an attacker inject a malicious artifact that the next pipeline stage processes as the stage's action role - supply-chain code injection into the pipeline.
awsderived
datapipeline:PutPipelineDefinition replaces the pipeline object graph including shell commands and scriptUri, giving the principal arbitrary code control over the pipeline's activities.
awsderived
CreateImage from a compromised instance bakes attacker-controlled disk contents into an AMI consumed by future launches (supply chain).
awsderived
An IAM principal with effective ecr:PutImage (+ layer-upload actions) on a repository can push/overwrite a mutable-tag image, injecting attacker code into every consumer that re-pulls that tag.
awsderived
An external principal granted ecr:PutImage via the repository's resource policy can push images (cross-account supply-chain attack).
awsderived
RegisterTaskDefinition authors the image/command/entryPoint a task runs = ECS-native code-authoring primitive.
awsderived
eks:CreateNodegroup combined with iam:PassRole (for a role trusting ec2.amazonaws.com or eks.amazonaws.com) allows an attacker to create a new managed node group with an attacker-controlled AMI or launch template. Every node in the group executes the attacker's code, and the attacker can escalate to the node group's IAM role.
awsderived
elasticmapreduce:AddJobFlowSteps lets a principal inject arbitrary executable steps into a running cluster.
awsderived
elasticmapreduce:RunJobFlow lets a principal create a new cluster with attacker-chosen bootstrap actions, AMI, and steps.
awsderived
emr-serverless:StartJobRun lets a principal submit a Spark/Hive job with attacker-controlled application code.
awsderived
emr-containers:StartJobRun lets a principal submit a Spark/Hive job with attacker-controlled application code on an EKS-hosted EMR virtual cluster.
awsderived
Update a Glue job's ScriptLocation to an attacker-controlled S3 object, establishing the code-modify and trigger facts needed for can-execute-as derivation.
awsderived
Overwrite the S3 object that a Glue job's ScriptLocation references (s3:PutObject), poisoning the ETL code; the next run executes as the job's IAM role.
awsderived
Overwrite a component's S3-backed document (s3:PutObject on the component URI bucket/key) to inject malicious steps that execute on the next build as the build instance role.
awsderived
Modify an Image Builder container recipe (or the pipeline referencing it) and trigger a build to push a poisoned container image to the target ECR repository, feeding the container-chains supply-chain fan-out to all downstream consumers.
awsderived
awsderived
Pushing an attacker image into the Lightsail private registry supplies the code a deployment will run.
awsderived
kafkaconnect:UpdateConnector with a new custom plugin revision replaces the connector's executable code, enabling arbitrary code execution as its service execution role.
awsderived
opsworks:CreateDeployment lets a principal run arbitrary Chef recipes or commands on stack instances as the instance profile role.
awsderived
opsworks:UpdateStack can redirect the custom cookbook source to an attacker-controlled repo, making all future cookbook deployments run attacker code as the instance profile role.
awsderived
s3:PutObject on a bucket that is a verified code-artifact deployment source (Lambda, CodePipeline, CloudFormation) for a compute workload equals modifying that workload's code.
awsderived
UpdateNotebookInstance changing the lifecycle config injects a shell script that runs as root on next start, within the notebook's execution role context.
awsderived
UpdatePipeline replacing the pipeline definition injects attacker-controlled step code that runs as the pipeline's execution role.
awsderived
servicecatalog:CreateProvisioningArtifact adds a new product version carrying an attacker-controlled CFN template. The next ProvisionProduct or UpdateProvisionedProduct using that version executes the attacker's template as the launch role bound to the product. cicd-chains propagates this CanModifyCode + ExecutesAs into CanExecuteAs.
awsderived
Write access to the S3 object backing a Service Catalog product version's template (LoadTemplateFromURL): the next ProvisionProduct or UpdateProvisionedProduct loads the attacker's template and executes it as the launch role. cicd-chains propagates this CanModifyCode + ExecutesAs into CanExecuteAs.
awsderived
ssm:UpdateDocument rewrites a customer-owned Automation document's steps - the executed definition of the BuildWorker runner.
awsderived
ssm:UpdateAssociation changes the document or command parameters of a State Manager association, injecting attacker code into the managed instances the association targets.
awsderived
A shared SSM Automation document gives the sharing-account identity code control over any BuildWorker in the target account that executes it.
awsderived
states:UpdateStateMachine allows replacing the ASL definition with arbitrary Task states that call AWS services as the execution role - equivalent to a buildspec rewrite.
awsderived
azurederived
AcrPush (registries/push/write) over the registry - supply-chain primitive consumed by container-chains.
azurederived
importImage/action copies an external image into a registry tag - supply-chain write equivalent to AcrPush.
azurederived
tasks/write over an ACR Task - modifies build steps (the BuildWorker's code) that run as the task's MI.
azurederived
runCommand/action can kubectl-apply attacker manifests - new/patched Deployments - changing what code runs as each workload identity.
azurederived
azurederived
azurederived
azurederived
azurederived
azurederived
Create or update a deploymentScript resource to run arbitrary PS/Bash as its attached UAMI.
azurederived
Principal with deployments/write at any scope can submit a deployment template containing an inline deploymentScript with attacker-controlled scriptContent.
azurederived
Overwrite a template spec version to inject a deploymentScript into all deployments that reference it.
azurederived
Overwrite or create a runbook (PowerShell/Python) in an Automation Account; content executes as the account MI on next job.
azurederived
Upload a malicious PowerShell module or Python package to an Automation Account; existing runbooks that Import-Module/import it execute the injected code as the account MI.
azurederived
Repoint the Automation Account's source control sync to an attacker-controlled repository; runbook code is replaced at next sync.
azurederived
azurederived
azurederived
azurederived
CAN_MANAGE on a notebook path allows overwriting notebook code via import/overwrite; runs as the cluster MI on next execution.
azurederived
CAN_MANAGE on a Databricks job allows updating the job task definition (notebook, JAR, wheel, script, DLT pipeline), injecting attacker code.
azurederived
Admin role on a SQL Warehouse allows running arbitrary SQL queries that execute as the warehouse MI.
azurederived
CAN_MANAGE on a Delta Live Tables pipeline allows repointing the notebook/library source, injecting attacker code.
azurederived
Cluster init scripts run as root before user code; write access to the init-script URI + cluster edit = code injection on every node.
azurederived
Overwrite an ADF pipeline definition to inject arbitrary activities (Web, Custom, Copy) that run as the factory MI.
azurederived
Overwrite an ADF Data Flow definition to inject attacker transformation logic running on the factory's Spark/IR cluster as the factory MI.
azurederived
Write access to the CI-trigger branch of the pipeline's source repo lets a principal inject code that the pipeline will execute on the next triggered run.
azurederived
Write to a shared YAML template repo/branch that a pipeline imports via 'extends: template', injecting code into all downstream pipelines that use it.
azurederived
azurederived
azurederived
azurederived
The admin runtime action can add/replace/delete functions, not just invoke them -> code modification.
azurederived
azurederived
azurederived
Swap a controlled slot into a higher-privilege slot -> the swapped-in code runs under the target slot's (more privileged) managed identity.
azurederived
Overwrite a Sentinel automation playbook's Logic App definition to inject attacker code that runs as the playbook's managed identity on the next incident trigger.
azurederived
Overwrite the Logic App workflow definition to inject arbitrary actions running as the workflow's MI.
azurederived
Deploy attacker code to a Standard Logic App via Kudu/SCM ZipDeploy (extensions/write).
azurederived
Hijack the source control of a Standard Logic App to an attacker repo (sourcecontrols/Write).
azurederived
Submit a training/pipeline/AutoML job whose command or script runs on the cluster as the compute MI.
azurederived
Overwrite a notebook on the workspace file share (via storage write); the notebook runs on a compute instance as the compute MI.
azurederived
Register a malicious custom Docker environment image; when a job references it, the attacker container runs as the cluster MI.
azurederived
Overwrite a shared pipeline component definition; future pipeline jobs using that component run attacker code as the cluster MI.
azurederived
Submit a job to an AKS cluster attached as an AML compute target; the job runs inside the AKS cluster as a Kubernetes workload, enabling lateral movement to non-AML K8s resources.
azurederived
Replace an online endpoint deployment's scoring script / model / environment; code executes as the endpoint MI on each inference request.
azurederived
Register an attacker application-type version and create/upgrade an app pointing at it -> attacker code runs in the cluster.
azurederived
Data-plane: an admin client cert/Entra admin can provision an app type and create an application, running attacker code.
azurederived
A holder of the SWA deployment token can modify the build runner's deployment when a runner with a service identity exists.
azurederived
Repoint SWA's source repository to an attacker-controlled repo, modifying build code.
azurederived
bigDataPools/write allows uploading custom library packages to a Spark pool; those libraries execute on Spark workers running as the workspace MI.
azurederived
Synapse Artifact Publisher role allows publishing pipelines with arbitrary Spark/custom/web activities; the workspace Workflow node executes them as the workspace MI.
azurederived
azurederived
azurederived
azurederived
Pushing/overwriting an image in a registry poisons every workload that pulls it - code control propagates from the registry to each consuming Compute/KubernetesWorkload.
derived
gcpderived
A principal with artifactregistry.repositories.uploadArtifacts can push/overwrite images or packages into the repo - the code-supply-chain write primitive feeding container-chains fan-out.
gcpderived
Moving a tag to a different digest (artifactregistry.tags.update) is equivalent to a code push - mutable-tag consumers that re-pull will run the new image.
gcpderived
A principal that can set a repo's IAM policy can self-grant roles/artifactregistry.writer and then push, reaching CanModifyCode on the repo via policy manipulation.
gcpderived
A repository granting uploadArtifacts to allUsers allows any unauthenticated attacker on the public internet to push code - the most critical supply-chain injection vulnerability.
gcpderived
cloudbuild.builds.create gives the principal full control of build steps executed as the legacy Cloud Build service account, with no actAs requirement.
gcpderived
cloudbuild.builds.create + iam.serviceAccounts.actAs on a user SA: submit arbitrary build steps as that SA.
gcpderived
cloudbuild.triggers.update lets the principal replace a trigger's build definition (inline steps, cloudbuild.yaml path, or substitutions); the next trigger fire executes the attacker-controlled definition as the trigger's SA.
gcpderived
cloudbuild.triggers.create + iam.serviceAccounts.actAs: create a new trigger whose builds execute attacker-controlled steps as a chosen SA.
gcpderived
clouddeploy.releases.create with actAs on the render SA injects attacker-controlled Skaffold config/hooks into the render Cloud Build worker.
gcpderived
clouddeploy.rollouts.create (promotion) with actAs on the deploy SA triggers the deploy Cloud Build worker running as the deploy SA.
gcpderived
Write access to the Cloud Deploy pipeline's GCS source bucket allows injecting malicious skaffold.yaml into every render job.
gcpderived
gcpderived
storage.objects.create on the Composer environment's GCS dags/ prefix injects a Python DAG file that Airflow executes as the environment SA; cite can-execute-as for the CanExecuteAs roll-up.
gcpderived
dataflow.jobs.updateContents on a streaming Dataflow job lets the principal inject attacker-controlled transforms into the live pipeline; updated code runs immediately as the worker SA.
gcpderived
Writing to the GCS object that serves as a Dataflow Flex or Classic Template poisons the next job created from that template; the job runs the attacker-controlled pipeline code as the worker SA.
gcpderived
dataproc.clusters.update on initializationActions (or the GCS path they reference) injects code that executes as the cluster SA on the next node join or cluster restart.
gcpderived
dataproc.workflowTemplates.update lets the principal modify the job DAG (steps, jars, main class) a workflow template runs as the cluster SA.
gcpderived
datafusion.instances.update (GCP IAM) + CDAP pipeline write access lets a principal deploy or replace a pipeline definition, injecting arbitrary code executed as the instance's dataprocServiceAccount on an ephemeral Dataproc cluster.
gcpderived
deploymentmanager.deployments.create allows submitting a new deployment config; DM executes it as the cloudservices service agent. This is the CI/CD CanModifyCode primitive for DM.
gcpderived
deploymentmanager.deployments.update allows replacing an existing deployment's config; DM re-executes as the cloudservices SA, enabling injection into an already-provisioned deployment.
gcpderived
gcpderived
Create a poisoned image/machine-image that future instances/templates boot from (supply chain).
gcpderived
gcpderived
storage.objects.create on the GCR artifacts bucket = push/overwrite a container image - code control over the registry and supply-chain poisoning of every consumer that pulls a mutable tag.
gcpderived
K8s RBAC deployments/update (or equivalent patch verb) on a Deployment lets a principal change the container image reference - direct CanModifyCode into the workload, triggering a rollout with attacker-controlled image.
gcpderived
artifactregistry.repositories.uploadArtifacts on an Artifact Registry repository (or storage.objects.create on a legacy GCR bucket) lets an attacker push/overwrite an image tag that GKE workloads pull - registry-level CanModifyCode, propagated by container-chains to each consuming workload.
gcpderived
A principal with source.repos.update can push commits to the CSR repository, including a modified cloudbuild.yaml - the code-supply-chain write primitive that arms any Cloud Build push trigger watching the target branch.
gcpderived
A principal that can set the repo IAM policy can self-grant roles/source.writer and then push commits - policy manipulation yields the same CanModifyCode as a direct writer binding.
gcpderived
workflows.workflows.update replaces the workflow's YAML/JSON definition, enabling injection of arbitrary Google API calls or HTTP steps that run as the runtime SA.
gcpderived
A principal with ecr:PutImage on an ECR repository can overwrite any mutable tag, poisoning every workload that pulls it.
awsexplicit
A principal holding the full ECR push permission set (BatchCheck + InitiateLayerUpload + UploadLayerPart + CompleteLayerUpload + PutImage) can push a complete new image.
awsexplicit
awsexplicit
opsworks:CreateDeployment grants ability to run arbitrary Chef recipes or commands on stack instances (execute_recipes / run_command).
awsexplicit
opsworks:UpdateStack lets a principal change the custom cookbook source URL, enabling cookbook supply-chain injection.
awsexplicit
opsworks:UpdateApp lets a principal change an app's source repository, enabling application supply-chain injection.
awsexplicit
azureexplicit
azureexplicit
azureexplicit
Principal can modify Workbench instance startup or post-startup script via notebooks.instances.update.
gcpexplicit
bigquery.transfers.update lets a principal change a scheduled query's SQL - the code the Transfer Service runs as the attached SA.
gcpexplicit
bigquery.routines.update on a REMOTE_FUNCTION Routine lets a principal change the Cloud Run endpoint the function invokes - effectively modifying the code/target at runtime.
gcpexplicit