CanModifyPolicy
Source can alter an identity/resource policy to grant itself/others more access. Produced both by explicit normalization (IAM/RBAC setPolicy grants) and by derived rules (deny-policy/org-policy modify capabilities that unlock gated edges).
Identity
── CanModifyPolicy ──▸
Policy, Identity, *
Source types
IdentityTarget types
PolicyIdentity*States
ACTIVE
CONDITIONAL
POTENTIAL
BLOCKED
UNKNOWN
Derivation
| nature | both |
|---|
Per-cloud
| cloud | permissions / triggers | note |
|---|---|---|
| aws |
iam:PutUserPolicy iam:AttachUserPolicy iam:CreatePolicyVersion iam:PutRolePolicy iam:AttachRolePolicy
|
|
| gcp |
*.setIamPolicy (e.g. resourcemanager.projects.setIamPolicy)
|
|
| azure |
Microsoft.Authorization/roleAssignments/write
|
Rules that emit CanModifyPolicy 86
Modifying a REST API resource policy (apigateway:PATCH/PUT) to grant execute-api:Invoke to external principals or Principal '*'.
awsderived
backup:PutBackupVaultAccessPolicy allows rewriting a backup vault's access policy, enabling an attacker to grant itself or an external account data-access permissions (StartRestoreJob, StartCopyJob).
awsderived
Rewriting the CodeArtifact domain resource policy can grant arbitrary principals publish access to all repositories in the domain - CanModifyPolicy over the domain policy node.
awsderived
Deleting the CodeArtifact domain resource policy removes all access controls and opens the publish surface to all principals with domain access - CanModifyPolicy via deletion.
awsderived
Rewriting a CodeArtifact repository resource policy can grant arbitrary principals publish access to that repository - CanModifyPolicy over the repository policy node.
awsderived
Deleting a CodeArtifact repository resource policy removes all access controls and opens the publish surface for that repository - CanModifyPolicy via deletion.
awsderived
Disabling or updating a Control Tower preventive control modifies the SCP guardrail backing it, removing its deny.
awsderived
dynamodb:PutResourcePolicy allows rewriting the table/stream resource policy, enabling self-grant of data-plane access or cross-account grant - a direct privilege escalation primitive.
awsderived
A principal with ecr:SetRepositoryPolicy can rewrite the repository resource policy to grant itself or any other principal push or pull access - policy-mutation escalation prerequisite.
awsderived
A principal with ecr:DeleteRepositoryPolicy can delete the repository resource policy, removing all access controls and cross-account restrictions - policy-mutation escalation.
awsderived
events:PutPermission allows a principal to rewrite a custom bus resource policy, injecting cross-account trust or public access.
awsderived
An identity with fsx:PutResourcePolicy on an FSx backup can rewrite the backup's resource policy to grant an external account fsx:CopyBackup access, staging a cross-account backup exfil without touching the live file system.
awsderived
awsderived
awsderived
kinesis:PutResourcePolicy on a stream grants the ability to rewrite the stream's resource policy, enabling privilege escalation via grant injection or cross-account access expansion.
awsderived
kafka:PutClusterPolicy allows writing the MSK cluster resource-based policy, enabling the attacker to grant kafka-cluster:WriteData (or ReadData) to arbitrary principals including cross-account ones.
awsderived
s3:PutBucketPolicy lets a principal rewrite the bucket policy in full, self-granting any S3 permission including making the bucket public.
awsderived
sns:SetTopicAttributes (Policy attribute) or sns:AddPermission rewrites or extends the SNS topic access policy, enabling self-grant of Publish/Subscribe or cross-account trust.
awsderived
sqs:SetQueueAttributes allows rewriting the queue resource policy (Policy attribute), enabling self-grant of sqs:SendMessage and the downstream trigger chain.
awsderived
A principal with sso:CreateTrustedTokenIssuer can register an external OIDC issuer configuration in IAM Identity Center, expanding the set of trusted token issuers - a policy modification capability.
awsderived
vpc-lattice:PutAuthPolicy lets a principal replace the auth policy on a service or service network, potentially opening services to unauthorized callers (remove org restriction, set Principal:*, disable auth type).
awsderived
scopeMaps/write allows a principal to modify repository-scoped token access policies, upgrading restricted tokens to include push/write capability.
azurederived
sqlRoleAssignments/write allows modifying Cosmos DB's native data-plane RBAC policy via role assignment creation/updates - enabling privilege escalation by assigning high-privilege roles to oneself.
azurederived
Write access to a Firewall Policy enables replacing or re-parenting the policy's basePolicy (policy hierarchy inheritance) or attaching the policy to additional Azure Firewalls, amplifying blast radius when a single policy controls multiple firewalls. This is a distinct capability from ruleCollectionGroups/write (which modifies rules only).
azurederived
azurederived
Ability to write Azure Policy assignments/definitions at a management group scope lets a principal weaken or remove a deny-effect guardrail inherited by the subtree.
azurederived
Write a policy exemption to remove a resource or scope from Azure Policy enforcement (governance evasion). For Deny-effect assignments this may unblock previously-denied ARM operations. This is a control-bypass / cover-tracks primitive - it does NOT directly grant access to the exempted resource.
azurederived
Overwrite a custom policy definition to change its effect from Deny (or Audit) to Disabled or Audit, neutralizing a guardrail that applies wherever that definition is assigned - potentially subscription-wide or org-wide. This is a stealthy defense-evasion primitive that modifies the definition rather than creating a visible exemption.
azurederived
Overwrite a custom policy set definition (initiative) to change the effect of bundled policy rules from Deny (or Audit) to Disabled or Audit, neutralizing a guardrail that applies wherever that initiative is assigned - potentially subscription-wide or org-wide. An initiative can bundle multiple deployIfNotExists or Deny rules; overwriting one has the same org-wide blast radius as modifying a single policyDefinition. This is a stealthy defense-evasion primitive.
azurederived
Modify an existing policy assignment's parameters, scope, or enforcement mode to weaken or disable its guardrail effect (e.g., set enforcementMode=DoNotEnforce to turn a Deny assignment into an audit-only posture, or narrow the scope). Applies to any effect type. This is governance evasion - separate from the execution-path rule (rule 1) which targets deployIfNotExists/modify assignments with a bound MI.
azurederived
servers/administrators/write allows modifying the Entra admin assignment, which is equivalent to modifying the SQL access policy (who holds db_owner on all databases).
azurederived
managedInstances/administrators/write allows modifying the Entra admin assignment on the MI, which is equivalent to modifying the SQL access policy (who holds db_owner on all MI databases).
azurederived
A principal who can delete the owning Blueprint/Managed-App or remove a deny-effect policy assignment can lift the guardrail suppressing inherited control edges.
azurederived
Identity that can grant policyAdmin at access policy scope gains full perimeter control.
gcpderived
artifactregistry.repositories.setIamPolicy grants full control over the repo's IAM allow policy - self-grant writer access, then push to poison consumers.
gcpderived
caPools.setIamPolicy writes the pool's IAM allow policy (grant self/others any access).
gcpderived
cloudbuild.connections.setIamPolicy lets the principal grant or revoke access to a Cloud Build repository connection, potentially enabling unauthorized source token access.
gcpderived
clouddeploy.deliveryPipelines.setIamPolicy lets the principal modify the pipeline's IAM policy, granting itself releases.create / rollouts.create.
gcpderived
clouddeploy.deployPolicies.override bypasses a Cloud Deploy time-window restriction, enabling rollouts during governance freeze windows.
gcpderived
gcpderived
dataproc.clusters.setIamPolicy lets a principal rewrite the cluster's IAM policy - self-granting dataproc.jobs.create -> CanExecuteCommand -> CanExecuteAs.
gcpderived
eventarc.triggers.setIamPolicy lets an attacker grant itself roles/eventarc.developer (trigger update/create) on the trigger, enabling destination redirect or filter widening.
gcpderived
eventarc.messageBuses.setIamPolicy lets an attacker grant itself eventarc.messageBuses.publish on a message bus, enabling direct event injection into all bound pipelines.
gcpderived
datastore.databases.setIamPolicy writes the Firestore database IAM allow policy; the caller can grant any principal (including itself) any role on the database.
gcpderived
firebase.rules.rulesets.create + firebase.rules.releases.update allows a principal to replace the active Firebase Security Rules with an attacker-controlled permissive ruleset, opening the Firestore database to internet access via the Firebase client SDK.
gcpderived
gcpderived
storage.buckets.setIamPolicy on the GCR artifacts bucket = rewrite the registry IAM policy, enabling cross-project push grants, public pull, or access revocation.
gcpderived
Principal with iam.denypolicies.update or .delete can remove/weaken a deny policy, upgrading the edges it was blocking.
gcpderived
gcpderived
gcpderived
Remove/weaken iam.disableServiceAccountKeyCreation to re-enable SA key creation.
gcpderived
Remove iam.disableServiceAccountKeyUpload to allow binding an attacker keypair to an SA.
gcpderived
Weaken iam.allowedPolicyMemberDomains to allow granting roles to external identities.
gcpderived
Remove iam.automaticIamGrantsForDefaultServiceAccounts to re-enable over-privileged default SAs on new resources.
gcpderived
Weaken compute.vmExternalIpAccess to allow assigning public IPs to VMs (internet exposure).
gcpderived
Remove storage.publicAccessPrevention to allow making Cloud Storage buckets public.
gcpderived
Remove sql.restrictPublicIp to allow Cloud SQL instances to get a public IP.
gcpderived
orgpolicy.policy.set over ANY enforced OrganizationPolicy that blocks a modeled edge = guardrail-removal capability over it.
gcpderived
Delete/alter a custom org-policy constraint that enforces a security invariant, unblocking what it suppressed.
gcpderived
A principal with compute.snapshots.setIamPolicy can grant themselves or a cross-project principal access to the snapshot, enabling data exfiltration or unauthorized cross-project reads.
gcpderived
pubsub.topics.setIamPolicy allows rewriting the topic IAM policy, enabling self-grant of pubsub.topics.publish and the downstream trigger chain.
gcpderived
pubsub.subscriptions.setIamPolicy allows rewriting the subscription IAM policy, enabling self-grant of pubsub.subscriptions.consume for credential/secret extraction via credential-chains.
gcpderived
secrets.setIamPolicy writes the secret's IAM allow policy (grant self/others any access).
gcpderived
source.repos.setIamPolicy grants full control over the repository's IAM allow policy - self-grant roles/source.writer, then push to arm Cloud Build triggers.
gcpderived
cloudtasks.queues.setIamPolicy lets an attacker grant itself cloudtasks.tasks.create (task enqueue) or cloudtasks.queues.update (queue config change) on the queue, completing either the trigger-escalation or the SA-swap path.
gcpderived
workflows.workflows.setIamPolicy lets an attacker grant itself roles/workflows.editor (CanModifyCode path) or roles/workflows.invoker (CanInvoke path) on the workflow.
gcpderived
awsexplicit
A principal with elasticfilesystem:PutFileSystemPolicy can rewrite the EFS file system resource policy.
awsexplicit
awsexplicit
awsexplicit
awsexplicit
awsexplicit
awsexplicit
azureexplicit
azureexplicit
gcpexplicit
gcpexplicit
gcpexplicit
gcpexplicit
gcpexplicit
gcpexplicit
gcpexplicit
gcpexplicit
Principal holds notebooks.instances.setIamPolicy on a Workbench instance (explicit permission normalization).
gcpexplicit
bigquery.datasets.update lets a principal modify the dataset-native ACL (access[] entries), including adding authorized views and broad access entries.
gcpexplicit
bigquery.rowAccessPolicies.update or .delete lets a principal delete or broaden row-level security policies, gaining full-table access for themselves or others.
gcpexplicit