Account
AWS account - hard isolation + billing boundary.
class: AdministrativeBoundary
Realizing resources
aws aws
| resource | scope | enumerate | required permissions |
|---|---|---|---|
aws:account:region |
global | account:ListRegions |
account:ListRegions |
aws:organizations:account |
global | organizations:ListAccounts |
organizations:ListAccounts |
As edge target
Exposure sites
None.
Rules that touch Account 65
A management-account principal that can assume OrganizationAccountAccessRole enters the member account as full admin.
aws
CanEnterAccountCross-account issuance on a CA whose certs are trusted in the owner account enters that account.
aws
CanEnterAccountA cross-account principal that can start or modify a CodeBuild build gains a foothold in the project's account via the service role.
aws
CanEnterAccountcloudformation:CreateStackInstances / UpdateStackSet in the admin account deploys to target accounts, executing as the StackSet execution role there - a cross-account foothold.
aws
CanEnterAccountA principal with cloudfront:CreateDistribution can create new distributions pointing at any origin (S3 bucket, ALB, API Gateway, custom endpoint). If an S3 bucket has an overly-broad OAC policy grant (missing aws:SourceArn condition), the attacker can create a distribution to expose its contents publicly.
aws
CanCreatePrincipal with cloudtrail:LookupEvents can query 90 days of account-wide management-event history without S3 access, exposing IAM principal names, access-key IDs, resource ARNs, and error codes - useful for recon and lateral movement planning.
aws
CanReadCreating a managed account via Account Factory yields a new account pre-seeded with an admin role the creator can assume - creation is entry.
aws
CanEnterAccountA management-account principal that can assume AWSControlTowerExecution enters every enrolled member account as administrator.
aws
CanEnterAccountA Direct Connect Gateway-to-TransitGateway association spanning account boundaries establishes network-layer trust (on-prem has routed path into remote account's VPCs).
DocumentDB cluster snapshot is shared for restore with a specific external AWS account via rds:DescribeDBClusterSnapshotAttributes (restore attribute contains account ID).
A principal in the snapshot's restore-authorized account with rds:RestoreDBClusterFromSnapshot can restore a shared DocumentDB cluster snapshot to a new cluster, obtaining full read access to all original data without network access to the source cluster.
aws
CanReadDataAn EventBridge custom bus resource policy granting events:PutEvents to a principal in another account establishes cross-account publish trust; the external principal can inject events that trigger compute consumers in this account.
A snapshot is shared to an external AWS account via ec2:DescribeSnapshotAttribute.
A principal with ecr:PutReplicationConfiguration can change the registry's replication destination settings, enabling supply-chain image interception and poisoning across all repositories in the account.
An EFS file system with no explicit file system policy (PolicyNotFound) is fully accessible to any same-account IAM principal that can network-reach the mount target.
aws
ExposedToAccountA Kinesis stream resource policy granting kinesis:PutRecord(s) to a principal in another account is cross-account publish trust, enabling that external principal to trigger the stream's Lambda consumer.
A Kinesis stream resource policy granting read actions (GetRecords/GetShardIterator/SubscribeToShard) to a foreign account enables that account to read the stream's records, supporting data exfiltration.
Cross-account decrypt that unlocks THIS account's credentials is an account foothold.
aws
CanEnterAccountAn external principal permitted by the key policy/grant can use the key cross-account.
aws
CanDecryptCross-account principal that can run code in a function enters this account.
aws
CanEnterAccountAn LF admin (or GRANT OPTION holder) granting Lake Formation SELECT / INSERT / DATA_LOCATION_ACCESS to a principal ARN in a foreign AWS account creates cross- account data-lake trust: the external principal can query this account's governed data via their own analytics services.
An MSK cluster resource-based policy granting kafka-cluster:WriteData or ReadData to a principal in another account is cross-account publish/consume trust; feeds messaging-chains rule 4 and can-control's CanEnterAccount derivation.
Neptune cluster snapshot with public restore attribute (restore=all) is immediately exfiltrable by any AWS account via RestoreDBClusterFromSnapshot.
aws
CanExfiltrateNeptune cluster snapshot is shared for restore with a specific external AWS account via neptune:DescribeDBClusterSnapshotAttributes (restore attribute contains account ID).
Neptune cluster snapshot with public restore attribute (restore=all) is exposed to the internet via CrossAccountTrust to external Account.
Neptune cluster snapshot is publicly restorable (restore attribute contains 'all') via neptune:DescribeDBClusterSnapshotAttributes, establishing a CrossAccountTrust.
Domain access policy grants es:ESHttp* to a principal in a foreign AWS account, enabling cross-account data access without a role assumption.
quicksight:RegisterUser + quicksight:UpdateUser (role=ADMIN) lets an attacker promote themselves or others to QuickSight admin, gaining read access to all datasets, dashboards, and data source configurations.
An attacker who can modify QuickSight's configuration (UpdateAccountSettings) and pass an IAM role to it gains execution as that role for all data queries.
aws
CanExecuteAsA shared subnet collapses the inter-account network boundary: consumer workloads launched into the shared subnet are on-link with owner-account resources, yielding on-subnet network reachability.
aws
CanNetworkReachA shared Transit Gateway enables the consumer VPC to reach owner-account resources attached to the TGW, derived from the CrossAccountTrust fact and confirmed TGW attachments.
aws
CanNetworkReachredshift:AuthorizeDataShare grants a consumer AWS account real-time read access to producer cluster objects, establishing cross-account live data trust.
redshift-serverless:PutResourcePolicy allows a principal to grant another AWS account live access to a Redshift Serverless namespace via resource policy.
A principal in account B provisioning a product from a portfolio shared by account A (servicecatalog:ProvisionProduct) causes resources to be deployed in account A as the account-A launch role. The receiving-account principal effectively gains a foothold in account A via the launch role's permissions.
aws
CanEnterAccountCross-account read of a secret that is credentials for a local identity is a foothold in this account.
aws
CanEnterAccountA queue resource policy granting sqs:SendMessage to a principal in another account is cross-account publish trust; fed by messaging-chains rule 4 to derive CanEnterAccount.
A principal in account A that can execute commands on an instance in account B, which runs as a role in account B, gains a foothold in account B.
aws
CanEnterAccountA consumer reads a RAM-shared SecureString whose creds grant the owning account.
aws
CanEnterAccountA consumer-account VPC with a confirmed (state==available) attachment to an owner-account Transit Gateway has L3 network reachability to subnets in the owner account (subject to TGW route table routing and L4 security group evaluation). This is a network-layer foothold (CanNetworkReach), not control-plane account entry (CanEnterAccount).
aws
CanNetworkReachA VPC peering connection whose requester and accepter VPCs belong to different AWS accounts represents cross-account network trust. The peering connection record in the accepting account's AWS account constitutes the cross-account authorization artifact, enabling principals in the peer account to reach resources in this account if SG/routing permits.
A VPC endpoint policy (gateway or interface) granting access to principals in another AWS account enables cross-account access to the backing PaaS service via the endpoint path. The endpoint policy resource is the trust artifact (modeled as ResourcePolicy source).
A PrivateLink producer endpoint with an explicit permission granting access to a foreign account principal is exposed to cross-account consumption. This is a structural fact representing the intended cross-account data-plane exposure.
aws
ExposedToAccountA VPC Lattice service network or service with authType NONE is accessible to any client in any associated VPC without IAM authentication - account-scoped exposure (or broader if the network is RAM-shared).
aws
ExposedToAccountA consumer account principal with CreateServiceNetworkVpcAssociation on a RAM-shared service network can associate their VPC, gaining cross-account private reachability to owner-account services.
aws
CanNetworkReachlistKeys/action returns ADLS Gen2 account keys, bypassing all RBAC and ACLs.
azure
CanReadCredentialAn Automation Account sandbox job exposes its bound MI's token to any code it runs via the IMDS endpoint.
azure
ExposesCredentialCode executing in an Automation Account sandbox can retrieve a bearer token for the bound MI from IMDS.
azure
CanRetrieveTokenShowing 60. Filter all rules for Account.