ExposesCredential
Resource contains/leaks a credential usable for the target identity (env var, code, connstring, metadata, API key). Target can be a Credential, Identity, or Secret/APIKey node.
Compute, Storage, Data, Messaging, Secret, Cache
── ExposesCredential ──▸
Credential, Identity, Secret
Target types
States
ACTIVE
CONDITIONAL
POTENTIAL
BLOCKED
UNKNOWN
Derivation
| nature | derived |
|---|
Rules that emit ExposesCredential 97
An exportable ACM certificate exposes its private key to any principal that can export it.
awsderived
An Amplify App build exposes the service role's session credentials to code running in the build.
awsderived
An API Gateway integration's credentials field references an IAM role; reading the integration config reveals which role the API uses as its execution identity.
awsderived
Running service exposes instance-role credentials via the container credential endpoint.
awsderived
Reading a launch template/config exposes hardcoded secrets/credentials embedded in UserData or launch data.
awsderived
Beanstalk EC2 instances leak the instance profile creds via IMDS (169.254.169.254).
awsderived
Environment option settings / environment properties often store plaintext secrets readable via DescribeConfigurationSettings.
awsderived
A CloudHSM client host with a configured CU login leaks it to any code it runs.
awsderived
A CodeBuild project environment variable with type PLAINTEXT whose value pattern-matches credential material exposes that credential to build code.
awsderived
The build container exposes the project service role's short-lived credentials via the ECS task-credential endpoint.
awsderived
CodeDeploy lifecycle hook scripts (running as root on EC2/on-prem targets) can read the instance profile role credentials from IMDS, exposing them to the attacker's code.
awsderived
A pipeline's EC2 or EMR resource node exposes the resourceRole's temporary credentials to any code running in its activities via the IMDS endpoint.
awsderived
The instance itself exposes its role's credentials via IMDS.
awsderived
awsderived
The mounted peer volume leaks any on-disk credentials/keys to the attacker who mounted it.
awsderived
EC2-launch container reaches host IMDS and reads the container-instance role.
awsderived
Pods on EC2 managed nodes with IMDS hop-limit >= 2 can reach 169.254.169.254 and retrieve temporary credentials for the node group IAM role. Any code execution inside such a pod inherits the node role without any IRSA or Pod Identity annotation.
awsderived
Every EC2 node in an EMR cluster exposes the instance profile (JobFlowRole) credentials via the EC2 Instance Metadata Service (IMDS); any code running on the cluster can retrieve them.
awsderived
A Glue job's DefaultArguments or StartJobRun Arguments contain embedded credentials (connection strings, API keys, tokens) that are exposed via glue:GetJob or glue:GetJobRun.
awsderived
A Glue Connection stores JDBC/Kafka/OAuth credentials; glue:GetConnection returns the plaintext PASSWORD, exposing the database credential.
awsderived
A KMS-decryptable secret exposes the credential of the identity it belongs to once the KMS gate is satisfied.
awsderived
A function leaks its execution-role credentials to any code it runs.
awsderived
Cluster's ACL contains users (credentials); the cluster exposes those credentials to authenticated network access.
awsderived
An Amazon MQ broker exposes the wire-protocol credentials of its broker users; these are modeled as Credential nodes and grant data-plane publish/consume access.
awsderived
An MSK Connect connector exposes its service execution role credentials to all plugin code running within it via the ECS task-credential endpoint.
awsderived
An MSK Connect connector's configuration (readable via kafkaconnect:DescribeConnector) may contain embedded credentials for downstream data stores (JDBC passwords, S3 keys, API credentials).
awsderived
FGAC domain with internal user database exposes the master-user password to whoever can call es:UpdateDomainConfig.
awsderived
An OpsWorks-managed EC2 instance exposes its instance profile role credentials to any code that runs on it (via IMDS).
awsderived
A QuickSight data source that stores database credentials (CredentialPair / API key) exposes those credentials - readable by the QuickSight service and potentially exfiltrable by updating the data source endpoint.
awsderived
quicksight:CreateDataSource (relational types) with an attacker-controlled endpoint causes QuickSight to transmit credentials to that host on connection test/ingestion - SSRF-style credential exfiltration.
awsderived
SageMaker compute surfaces (notebook/training/processing job/pipeline/Studio app) expose execution-role credentials to all code running inside them via IMDS or the container credentials endpoint.
awsderived
PutSecretValue/UpdateSecret plants an attacker-controlled credential in the secret that any consumer refetches and trusts.
awsderived
A SecureString parameter exposes credential material to any reader.
awsderived
A managed instance exposes its instance-profile role credentials to any code running on it via the IMDS endpoint.
awsderived
A state machine exposes its execution role's credentials to any code injected into a Task state (AWS SDK calls are made with the execution role's session).
awsderived
A container group with a bound managed identity leaks that MI's credential to any in-container code via the local IMDS/IDENTITY_ENDPOINT - the credential-leak fact paired with azure-aci-imds-token.
azurederived
azurederived
azurederived
A principal with listKeys/action obtains the store's access-key connection strings (unless local auth is disabled).
azurederived
Companion to azure-appsvc-msi-token: the site exposes its bound MI's credential material via the MSI token endpoint reachable from in-worker code.
azurederived
Companion to azure-appsvc-publishxml: the site exposes its long-lived publishing-profile (SCM/FTP) credential via publishxml/action.
azurederived
Companion to azure-appsvc-config-list: the site exposes cleartext app-settings / connection-string secrets via config/list/action.
azurederived
An Automation Account sandbox job exposes its bound MI's token to any code it runs via the IMDS endpoint.
azurederived
An Automation Account with a legacy RunAs account exposes the RunAs service principal certificate to any runbook via Get-AutomationConnection.
azurederived
Pool startTask / job env settings / resource-file SAS URLs frequently embed secrets, readable at Reader level.
azurederived
A Batch pool that bears a user-assigned MI leaks that MI's credential to any code on its nodes via IMDS.
azurederived
The search service exposes its primary and secondary admin API keys (discoverable via listAdminKeys/action by principals holding Search Service Contributor, Contributor, or Owner roles). Admin keys grant full data-plane control of the search service (all indexes, indexers, data sources, and queries).
azurederived
The search service exposes one or more query API keys (discoverable via listQueryKeys/action by principals holding Search Service Contributor, Contributor, or Owner roles). Query keys grant read-only data-plane access (search, suggest, autocomplete queries against all indexes).
azurederived
listKeys/action returns Cosmos DB master keys, bypassing all data-plane RBAC and network controls.
azurederived
listConnectionStrings/action returns connection strings embedding the Cosmos DB master keys - equivalent credential exposure to listKeys.
azurederived
readonlykeys/action returns Cosmos DB read-only master keys - bypasses data-plane RBAC for read operations across all databases and containers.
azurederived
A cluster with a bound Access Connector MI leaks that MI's credential to any code running on it via IMDS.
azurederived
An ADF linked service stores a long-lived embedded credential (connection string, storage key, SP secret) exposed to pipeline runs.
azurederived
A Self-Hosted IR node VM stores encrypted linked service credentials in its local credential store; OS-level access to the node decrypts them.
azurederived
An ARM service connection (secret-based) injects the backing SP's client secret / certificate into the job environment; pipeline code can read and exfiltrate it.
azurederived
A disk that can be SAS-exported and contains secrets exposes those credentials as accessible to external parties. The state (ACTIVE vs CONDITIONAL) depends on the CanExfiltrate edge state.
azurederived
An Event Grid topic exposes its access key to any principal who can call listKeys/action; the key is a long-lived publish credential for the topic.
azurederived
A namespace or entity authorization rule with usable SAS keys (disableLocalAuth=false) embeds connection-string credential material; any holder of the keys can authenticate to the Event Hubs data plane.
azurederived
A Function app with a bound MI leaks that MI's credential to any code running in the app via the App Service identity endpoint.
azurederived
A Standard Logic App with a bound MI exposes that MI's credential to any code/action running in the app.
azurederived
An API connection stores a long-lived service credential (key/token) usable by any code that can call listConnectionKeys.
azurederived
Any code running on an AML compute node can mint the compute MI's token from IMDS - the MI credential is exposed to all job code.
azurederived
An AML datastore configured with accountKey/SAS/servicePrincipal credential exposes that credential to principals with listsecrets.
azurederived
A wrapped store whose wrapping key the principal can decrypt exposes the credential it holds.
azurederived
A host with a bound MI exposes that identity's bearer token credential via the IMDS / App Service identity endpoint to any code running inside it.
azurederived
The Redis access keys are exposed via the cache resource whenever a principal with listKeys/action can retrieve them. This is a structural credential-exposure edge: the cache itself exposes the keys as a resource-level property, coupled with a principal's CanReadCredential permission.
azurederived
A Service Bus namespace with readable SAS keys exposes its connection-string credential to any principal with listKeys access.
azurederived
An MI-enabled SF application leaks a usable credential for its managed identity via the per-node localhost token service environment.
azurederived
A Static Web App exposes its deployment token as a credential for the CI/CD pipeline identity.
azurederived
A Synapse linked service that stores credentials as plaintext (SQL auth password, storage key, SAS token) exposes those credentials to any principal with Synapse Linked Data Manager or Synapse Administrator role.
azurederived
The Synapse workspace exposes the workspace managed identity credential to all Spark jobs and pipeline activities via IMDS (169.254.169.254).
azurederived
A VM bound to a managed identity leaks that identity's credential via the IMDS token endpoint (the exposure fact paired with azure-vm-imds-token).
azurederived
azurederived
Code running in the job VM reads the runtime SA token from the GCE metadata server.
gcpderived
All Cloud Build steps can mint OAuth tokens for the build SA from the GCE metadata server; code execution in any step yields the build SA's credentials.
gcpderived
All Composer DAG task executions can mint OAuth tokens for the environment SA from the GKE metadata server; code execution in any DAG task yields the environment SA's credentials.
gcpderived
Dataflow worker SA credentials accessible via metadata server to code running in pipeline transforms (when execution is established via CanModifyCode or CanExecuteAs).
gcpderived
A Dataproc cluster exposes its service account's OAuth token to any code running in submitted jobs via the GCE metadata server.
gcpderived
All Dataproc nodes in a Data Fusion pipeline cluster can retrieve OAuth tokens for the dataprocServiceAccount from the GCE metadata server; code execution in any pipeline step yields those credentials.
gcpderived
Datastream ConnectionProfile resources store source DB credentials (username/password or SSH private key). An attacker with write access (connectionProfiles.create/update) can harvest credentials by redirecting a test connection to a controlled host; secretManagerStoredPassword references expose Secret Manager paths.
gcpderived
Metadata server vends the attached SA's OAuth token to on-host code.
gcpderived
gcpderived
startup-script / custom metadata frequently embeds secrets, readable via instances.get.
gcpderived
Code running in the function reads the runtime SA token from the metadata server.
gcpderived
A GKE node pool with workloadMetadataConfig.mode != GKE_METADATA allows pods to reach the GCE metadata server and read the node pool SA's OAuth token - the node SA credential is exposed to every pod on those nodes.
gcpderived
redis.instances.getAuthString retrieves the Redis AUTH string (UUID), which is the shared credential granting full Redis data-plane access to any in-VPC client that possesses it. This is the Memorystore "master key" credential grab.
gcpderived
A Pub/Sub push subscription delivers a Google-signed OIDC token for its pushConfig.oidcToken.serviceAccountEmail to the push endpoint on every delivery; code at the endpoint can extract and replay the token, exposing the push SA's identity.
gcpderived
A Cloud Tasks HTTP target queue configured with httpTarget.oidcToken.serviceAccountEmail (or oauthToken) attaches a minted token for that SA to every dispatched request, exposing the SA's credential to the consumer endpoint.
gcpderived
Setting httpTarget.uriOverride to an attacker-controlled endpoint (via cloudtasks.queues.update, no actAs needed) redirects all future dispatches there - delivering the queue's OIDC/OAuth SA token and task body payloads to the attacker.
gcpderived
A training job or Workbench notebook exposes its runtime SA credentials to any code it runs via the GCE metadata server.
gcpderived
Any code running inside a workflow (via definition control) can exfiltrate the runtime SA token via an outbound http.request step to an attacker-controlled endpoint.
gcpderived
Every EC2 node in an EMR cluster exposes the instance profile (JobFlowRole) credentials via the EC2 Instance Metadata Service (IMDS); any code running on the cluster can retrieve them.
awsexplicit
EMR step arguments (jar args, script args) may contain hardcoded DB passwords, access keys, or connection strings visible via DescribeStep.
awsexplicit
azureexplicit
azureexplicit
gcpexplicit
A BigQuery Connection resource stores or proxies credentials to an external data source (Cloud SQL, JDBC, Spark); a principal with bigquery.connections.use gains effective access to that external system.
gcpexplicit
Exposure sites that emit ExposesCredential 122
ExportCertificate.PrivateKey
awscritical
GetWebhook.webhook.webhookUrl
awshigh
GetApiKey.value (includeValue=true)
awscritical
DescribeStacks.Stacks[].Outputs[].OutputValue
awscritical
CloudHSM client PKCS#11/JCE/OpenSSL key object with EXTRACTABLE=true
awscritical
GetAuthorizationToken.authorizationToken
awscritical
BatchGetBuilds.builds[].exportedEnvironmentVariables[].value
awscritical
CreateWebhook.webhook.secret
awscritical
ListActionExecutions.actionExecutionDetails[].output.outputVariables.<value>
awscritical
DescribeUserPoolClient.UserPoolClient.ClientSecret
awscritical
PollForTask.taskObject.objects.<object-id>.fields[].stringValue
awscritical
DescribeVirtualInterfaces.virtualInterfaces[].authKey
awscritical
DescribeRouterConfiguration.customerRouterConfig
awscritical
CreateKeyPair.KeyMaterial
awscritical
GetPasswordData.PasswordData
awshigh
GetConnection.Connection.ConnectionProperties.{USERNAME,PASSWORD,JDBC_CONNECTION_URL,CUSTOM_*}
awscritical
CreateAccessKey.AccessKey.SecretAccessKey
awscritical
CreateServiceSpecificCredential.ServiceSpecificCredential.ServicePassword
awscritical
Decrypt.Plaintext
awscritical
GenerateDataKey.Plaintext
awscritical
GenerateDataKeyPair.PrivateKeyPlaintext
awscritical
GenerateRandom.Plaintext
awshigh
GetRelationalDatabaseMasterUserPassword.masterUserPassword
awscritical
GetSensitiveDataOccurrences.sensitiveDataOccurrences.<type>[].value
awscritical
DescribeApps.Apps[].AppSource.Password / SshKey
awscritical
DescribeApps.Apps[].SslConfiguration.PrivateKey
awscritical
DescribeRdsDbInstances.RdsDbInstances[].DbPassword
awscritical
GenerateEmbedUrlForRegisteredUser.EmbedUrl
awscritical
GenerateEmbedUrlForAnonymousUser.EmbedUrl
awscritical
GetClusterCredentials.DbPassword
awscritical
CreateSession.CredentialSet[].Credentials.SecretAccessKey / SessionToken
awscritical
DescribeRecord.RecordOutputs[].OutputValue
awscritical
GetPlatformApplicationAttributes.Attributes.PlatformCredential / PlatformPrincipal
awscritical
AssumeRole.Credentials.SecretAccessKey / SessionToken
awscritical
GetFederationToken.Credentials.SecretAccessKey / SessionToken
awscritical
AssumeRoleWithWebIdentity.Credentials.SecretAccessKey / SessionToken
awscritical
AssumeRoleWithSAML.Credentials.SecretAccessKey / SessionToken
awscritical
DescribeVpnConnections.VpnConnections[].CustomerGatewayConfiguration
awscritical
GetWebACL.WebACL.CustomResponseBodies.<key>.Content
awscritical
sql.sslCerts.insert.clientCert.certPrivateKey
gcpcritical