ExecutesAs
A workload (Compute or Messaging) runs under the target identity. Zero-cost link (a fact, not an action) enabling CanExecuteAs derivations. Includes orchestration workflows, logic apps, and event consumers running as a specified identity.
Compute, Messaging, AnalyticsService, DataWarehouse, DataLake, Data
── ExecutesAs ──▸
Identity, ServiceIdentity, MachineIdentity, ServiceAccount, ManagedIdentity, Role
Source types
Target types
States
ACTIVE
CONDITIONAL
POTENTIAL
BLOCKED
UNKNOWN
Derivation
| nature | explicit |
|---|
Per-cloud
| cloud | permissions / triggers | note |
|---|---|---|
| aws | - | |
| gcp | - | |
| azure | - |
Rules that emit ExecutesAs 69
A Batch job/task executes as the jobRoleArn bound to its job definition.
awsderived
On EC2 compute environments the container host executes as the ECS instance role.
awsderived
Beanstalk environment provisions EC2 instances that run as the instance profile role.
awsderived
Beanstalk service acts as the environment service role.
awsderived
A CodeBuild project runs every build as its configured IAM service role.
awsderived
A pipeline's EC2 or EMR resource node executes as the IAM role in the pipeline's resourceRole field, making that role reachable via IMDS by any code the pipeline runs.
awsderived
The Data Pipeline service assumes the pipeline's `role` field to provision compute resources and access downstream AWS services on the pipeline's behalf.
awsderived
A running ECS task executes as its configured task role (taskRoleArn).
awsderived
The ECS agent for a task executes as the task execution role (executionRoleArn).
awsderived
An EventBridge rule assumes its invocation RoleArn (via events.amazonaws.com) to call targets that require IAM authorization; code running as that rule effectively runs as the invocation role.
awsderived
An EventBridge Scheduler schedule assumes its Target.RoleArn (via scheduler.amazonaws.com) at each fire; anyone who can modify the schedule or the role effectively runs as that role on a cadence.
awsderived
An MSK Connect connector runs its plugin code as the configured IAM service execution role.
awsderived
A Step Functions state machine runs every execution as its configured IAM execution role.
awsderived
An Automation Account sandbox job executes as the bound managed identity; any code running in the sandbox can mint MI tokens from IMDS.
azurederived
azurederived
A self-hosted pipeline agent (VirtualMachine) runs as its OS user / managed identity, providing a second execution identity for all pipelines on that agent.
azurederived
An Azure Policy remediation task (modeled as BuildWorker - the ARM deployment runner) executes as the managed identity bound in the policy assignment's identity block. Zero-cost structural fact; can-execute-as execute-as-via-code-modify and cicd-chains cicd-modify-buildspec-executes-as consume this to produce CanExecuteAs.
azurederived
azurederived
An App Engine instance (Compute) runs as its configured (or default appspot) service account, inherited from the version's serviceAccount binding.
gcpderived
gcpderived
A Cloud Build trigger's builds execute as the configured service account (or the legacy SA if none is set).
gcpderived
Cloud Deploy job run worker (Cloud Build) executes as the target's configured execution service account.
gcpderived
Every Deployment Manager deployment runs as the Google APIs service agent (PROJECT_NUMBER@cloudservices.gserviceaccount.com), which by default holds roles/editor at the project.
gcpderived
Instance runs as the SA in its serviceAccounts[] config.
gcpderived
gcpderived
Explicit extraction: a pipeline's EC2 or EMR resource node runs as the IAM role specified in the resourceRole field.
awsexplicit
Explicit extraction: the Data Pipeline service assumes the role specified in the role field.
awsexplicit
Each EC2 instance in an EKS managed node group runs as the node group IAM role (nodeRole).
awsexplicit
A pod whose ServiceAccount has an IRSA annotation executes as the annotated IAM role (credentials delivered by token projection + STS).
awsexplicit
A pod whose SA is linked via an EKS Pod Identity Association executes as the associated IAM role (credentials delivered by the pod-identity-agent DaemonSet at 169.254.170.23).
awsexplicit
An EMR cluster and every step/application running on it execute as the cluster's EC2 instance profile (JobFlowRole).
awsexplicit
An EMR Serverless job run executes as the executionRoleArn provided at StartJobRun.
awsexplicit
An EMR on EKS job run executes as the IAM role bound to the virtual cluster's job execution binding (IRSA).
awsexplicit
awsexplicit
awsexplicit
OpsWorks-managed EC2 instance runs as its IAM instance profile role.
awsexplicit
OpsWorks Stack's control plane operates as the stack's service role.
awsexplicit
awsexplicit
A SageMaker notebook instance executes kernel code as its RoleArn (execution role).
awsexplicit
A SageMaker training job container executes as its RoleArn.
awsexplicit
A SageMaker processing job container executes as its RoleArn.
awsexplicit
A SageMaker Pipeline execution runs steps as its RoleArn.
awsexplicit
A SageMaker Studio App (JupyterServer/KernelGateway) executes as the UserProfile's ExecutionRole.
awsexplicit
An MLflow Tracking Server executes as its RoleArn.
awsexplicit
A SageMaker Model executes as its ExecutionRoleArn at serving (endpoint) and batch-transform time.
awsexplicit
azureexplicit
azureexplicit
azureexplicit
azureexplicit
azureexplicit
azureexplicit
azureexplicit
azureexplicit
azureexplicit
azureexplicit
azureexplicit
azureexplicit
azureexplicit
azureexplicit
azureexplicit
azureexplicit
azureexplicit
A policy assignment with a system-assigned managed identity produces an ExecutesAs edge: remediation tasks run as that system MI. Extracted from the assignment's identity.principalId field.
azureexplicit
A policy assignment with one or more user-assigned managed identities produces ExecutesAs edges for each. Extracted from the assignment's identity.userAssignedIdentities map (keys are MI resource IDs).
azureexplicit
An Eventarc trigger uses its serviceAccount field as the delivery identity when calling the destination endpoint.
gcpexplicit
Training job, pipeline job, or notebook execution job explicitly declares its service account.
gcpexplicit
Workbench notebook instance explicitly declares its service account.
gcpexplicit
A scheduled query with serviceAccountName set runs as that SA; zero-cost fact enabling cicd-chains derivation.
gcpexplicit