AnalyticsService
EMR/Databricks/Dataproc/Glue.
class: Data
Realizing resources
aws aws
| resource | scope | enumerate | required permissions |
|---|---|---|---|
aws:athena:workgroup |
regional | athena:ListWorkGroups |
athena:ListWorkGroups |
aws:emr:cluster |
regional | elasticmapreduce:ListClusters |
elasticmapreduce:ListClusters |
aws:quicksight:dashboard |
regional | quicksight:ListDashboards |
quicksight:ListDashboards |
gcp gcp
| resource | scope | enumerate | required permissions |
|---|---|---|---|
gcp:dataflow:job |
global | dataflow.projects.jobs.aggregated |
dataflow.jobs.list |
gcp:dataproc:cluster |
regional | dataproc.projects.regions.clusters.list |
dataproc.clusters.list |
azure azure
| resource | scope | enumerate | required permissions |
|---|---|---|---|
azure:cognitiveservices:account |
global | arg:microsoft.cognitiveservices/accounts |
Microsoft.CognitiveServices/accounts/read |
azure:databricks:workspace |
global | arg:microsoft.databricks/workspaces |
Microsoft.Databricks/workspaces/read |
azure:hdinsight:cluster |
global | arg:microsoft.hdinsight/clusters |
Microsoft.HDInsight/clusters/read |
azure:kusto:cluster |
global | arg:microsoft.kusto/clusters |
Microsoft.Kusto/clusters/read |
azure:ml:workspace |
global | arg:microsoft.machinelearningservices/workspaces |
Microsoft.MachineLearningServices/workspaces/read |
azure:purview:account |
global | arg:microsoft.purview/accounts |
Microsoft.Purview/accounts/read |
azure:streamanalytics:job |
global | arg:microsoft.streamanalytics/streamingjobs |
Microsoft.StreamAnalytics/streamingjobs/read |
azure:synapse:workspace |
global | arg:microsoft.synapse/workspaces |
Microsoft.Synapse/workspaces/read |
As edge source
As edge target
AuthenticatesToCanAdministerCanAttachIdentityCanControlCanCreateCanDeleteCanDeleteDataCanExecuteCommandCanExfiltrateCanModifyCanModifyCodeCanModifyConfigurationCanModifyPolicyCanNetworkReachCanReachPortCanReadCanReadDataCanReplaceCanScheduleCanTakeOwnershipCanTriggerCanWriteCanWriteDataContainsContainsResourceReferenceControlsCredentialsForHasPermissionPrivateReachabilityExposure sites
aws-accessanalyzer-finding-details-metadataaws-appflow-flow-data-destinationaws-athena-query-result-rowsaws-backup-recovery-point-restored-contentaws-bedrock-runtime-prompt-response-payloadaws-cloudfront-key-value-store-valueaws-cloudtrail-event-data-store-query-resultsaws-cloudtrail-event-request-response-payload
Rules that touch AnalyticsService 65
athena:UpdateWorkGroup lets a principal rewrite the workgroup output S3 location, redirecting subsequent users' query results to an attacker-controlled bucket.
A principal with athena:StartQueryExecution on a LAMBDA-catalog workgroup can trigger the registered Lambda connector function.
aws
CanTriggerathena:StartQueryExecution on an enabled workgroup, combined with s3:GetObject on the data prefix, s3:PutObject on the results output location, and Glue read permissions, enables the principal to read underlying data-lake content.
aws
CanReadDataAn Athena workgroup configured with a LAMBDA data catalog triggers the registered Lambda connector function.
aws
CanTriggerSwap a Bedrock Knowledge Base's service role via UpdateKnowledgeBase+PassRole to access data sources as an attacker-chosen role.
aws
CanExecuteAsA pipeline's EC2 or EMR resource node exposes the resourceRole's temporary credentials to any code running in its activities via the IMDS endpoint.
elasticmapreduce:AddJobFlowSteps lets a principal inject arbitrary executable steps into a running cluster.
aws
CanModifyCodeAn EMR cluster whose instance profile has s3:GetObject on a data lake bucket can read all objects in that bucket.
aws
CanReadDataS3 URI where EMR cluster logs are written; record as a resource reference for data discovery.
Submit a step to a running EMR cluster via AddJobFlowSteps; the step executes as the cluster's instance profile role without iam:PassRole.
aws
CanExecuteAsCreate a new EMR cluster with a privileged JobFlowRole via RunJobFlow + iam:PassRole; arbitrary bootstrap/step code executes as that role.
aws
CanExecuteAsAn EMR cluster and every step/application running on it execute as the cluster's EC2 instance profile (JobFlowRole).
aws
ExecutesAsAn EMR cluster whose instance profile has s3:PutObject on an attacker-controlled S3 bucket can exfiltrate data via Spark df.write or Hive INSERT OVERWRITE DIRECTORY.
aws
CanExfiltrateEvery EC2 node in an EMR cluster exposes the instance profile (JobFlowRole) credentials via the EC2 Instance Metadata Service (IMDS); any code running on the cluster can retrieve them.
Every EC2 node in an EMR cluster exposes the instance profile (JobFlowRole) credentials via the EC2 Instance Metadata Service (IMDS); any code running on the cluster can retrieve them.
Submit an EMR on EKS job run with attacker-controlled application code and a passed privileged execution role via emr-containers:StartJobRun + iam:PassRole.
aws
CanExecuteAsAn EMR on EKS job run executes as the IAM role bound to the virtual cluster's job execution binding (IRSA).
aws
ExecutesAsemr-containers:StartJobRun lets a principal submit a Spark/Hive job with attacker-controlled application code on an EKS-hosted EMR virtual cluster.
aws
CanModifyCodeelasticmapreduce:RunJobFlow lets a principal create a new cluster with attacker-chosen bootstrap actions, AMI, and steps.
aws
CanModifyCodeSubmit an EMR Serverless job run with attacker-controlled application code and a passed privileged executionRole via emr-serverless:StartJobRun + iam:PassRole.
aws
CanExecuteAsAn EMR Serverless job run executes as the executionRoleArn provided at StartJobRun.
aws
ExecutesAsemr-serverless:StartJobRun lets a principal submit a Spark/Hive job with attacker-controlled application code.
aws
CanModifyCodeWrite to EMR Studio workspace S3 backing to inject code into notebooks; notebook execution runs as Studio service role or attached cluster's JobFlowRole.
aws
CanExecuteAss3:PutObject on a bucket that is a verified code-artifact deployment source (Lambda, CodePipeline, CloudFormation) for a compute workload equals modifying that workload's code.
aws
CanModifyCodeAttach a user-assigned managed identity to a Data Factory (factories/write + assign/action on the MI), binding a higher-privilege identity to the factory's pipeline runs.
azure
CanAttachIdentityAn ADF factory with publicNetworkAccess=Enabled exposes its REST data-plane endpoint (adfstudio.azure.com + management.azure.com) to the internet.
azure
ExposedToInternetFull ARM control of the AML workspace grants administrative authority over all compute, jobs, datastores, and linked services.
azure
CanAdministerDatabricks workspace REST API endpoint is publicly reachable; any token/PAT holder can authenticate from the internet.
azure
ExposedToInternetAttach a user-assigned MI to the workspace (workspaces/write + assign/action); all Spark jobs and pipelines then run as both the system-assigned MI and the newly attached user-assigned MI.
azure
CanAttachIdentitybigDataPools/write allows uploading custom library packages to a Spark pool; those libraries execute on Spark workers running as the workspace MI.
azure
CanModifyCodeSynapse Artifact Publisher role allows creating schedule/event/tumbling-window triggers that repeatedly run pipelines - persistence mechanism for code execution as the workspace MI.
azure
CanScheduleAttach a privileged user-assigned MI to the workspace (CanAttachIdentity) + workspace gains a new ExecutesAs target -> all Spark/pipeline runs can mint tokens for the attached MI.
azure
CanCreateWorkloadAsSynapse workspace development, SQL, and Spark endpoints are public-internet reachable when publicNetworkAccess is Enabled and no private-endpoint-only restriction is applied.
azure
ExposedToInternetRetrieve IR auth key (CanReadSecret) + register a self-hosted IR node the attacker controls -> that node executes pipeline activities as the workspace MI. No generic linchpin covers this path; rule is Synapse-specific.
azure
CanExecuteAsUpload malicious library to a Spark pool (CanModifyCode) + the pool runs as the workspace MI (ExecutesAs) => execute code as the workspace MI. Cites can-execute-as.yaml execute-as-via-code-modify.
azure
CanExecuteAsPublish a pipeline with attacker code (CanModifyCode on workspace) + trigger it (CanTrigger) + workspace ExecutesAs MI => execute as workspace MI. Cites cicd-chains.yaml cicd-modify-buildspec-executes-as and can-execute-as.yaml.
azure
CanExecuteAsSynapse Compute Operator submits a Spark batch job via Livy API (CanExecuteCommand) + Spark pool runs as workspace MI (ExecutesAs) => execute attacker code as the workspace MI.
azure
CanExecuteAsAny code running on Synapse Spark/pipeline compute can mint a bearer token for the workspace MI via IMDS.
azure
CanRetrieveTokenSynapse Artifact Publisher role allows publishing pipelines with arbitrary Spark/custom/web activities; the workspace Workflow node executes them as the workspace MI.
azure
CanModifyCodeSynapse Compute Operator role allows triggering pipeline runs (createPipelineRun) on the workspace, executing whatever pipeline definition is currently published.
azure
CanTriggerCREATE EXTERNAL TABLE AS SELECT (CETAS) on the serverless SQL pool exports query results to an external storage location; if the workspace MI holds write access on attacker-controlled storage, data is exfiltrated.
azure
CanExfiltrateSynapse Compute Operator can submit Spark batch jobs and interactive sessions directly via the Apache Livy REST API endpoint at <workspace>.dev.azuresynapse.net/livyApi/..., triggering immediate job execution.
azure
CanTriggerSynapse Compute Operator role (or Synapse Administrator) allows submitting Spark batch jobs and interactive sessions via the Livy API, running attacker-supplied code on Spark workers.
azure
CanExecuteCommandThe Synapse workspace exposes the workspace managed identity credential to all Spark jobs and pipeline activities via IMDS (169.254.169.254).
azure
ExposesCredentialworkspaces/write allows changing the workspace identity block (attach/detach user-assigned MI), firewall rules, AAD admin, and integration runtime config - all alter execution identity or reach.
azure
CanModifyConfigurationModify code of a compute resource that runs as a privileged identity.
Change the execution identity binding of a compute resource to a chosen privileged identity.
storage.objects.create on the Composer environment's GCS dags/ prefix injects a Python DAG file that Airflow executes as the environment SA; cite can-execute-as for the CanExecuteAs roll-up.
gcp
CanModifyCodeAll Composer DAG task executions can mint OAuth tokens for the environment SA from the GKE metadata server; code execution in any DAG task yields the environment SA's credentials.
composer.environments.executeAirflowCommand lets the principal trigger an existing Airflow DAG run; CanExecuteAs is CONDITIONAL on the current DAG definition being attacker-influenced.
gcp
CanTriggercomposer.environments.update with softwareConfig.pypiPackages injects an attacker-controlled Python package installed on all workers and the scheduler, executing code as the environment SA at import time.
All Dataproc nodes in a Data Fusion pipeline cluster can retrieve OAuth tokens for the dataprocServiceAccount from the GCE metadata server; code execution in any pipeline step yields those credentials.
datafusion.instances.update (GCP IAM) + CDAP pipeline write access lets a principal deploy or replace a pipeline definition, injecting arbitrary code executed as the instance's dataprocServiceAccount on an ephemeral Dataproc cluster.
gcp
CanModifyCodedataproc.clusters.setIamPolicy lets a principal rewrite the cluster's IAM policy - self-granting dataproc.jobs.create -> CanExecuteCommand -> CanExecuteAs.
gcp
CanModifyPolicyclusters.update + actAs on the new SA attaches (swaps) the cluster's runtime SA - all future jobs run as the new SA.
dataproc.clusters.update allows changing the cluster's service account (and other runtime config), which with actAs on the new SA swaps the cluster's execution identity.
Showing 60. Filter all rules for AnalyticsService.