BatchJob

Change an existing Glue job's RoleArn to a passed privileged role via glue:UpdateJob + iam:PassRole; the next run executes as the new role.

Overwrite the S3 object that a Glue job's ScriptLocation references (s3:PutObject), poisoning the ETL code; the next run executes as the job's IAM role.

Update a Glue job's ScriptLocation to an attacker-controlled S3 object, establishing the code-modify and trigger facts needed for can-execute-as derivation.

A Glue job's DefaultArguments or StartJobRun Arguments contain embedded credentials (connection strings, API keys, tokens) that are exposed via glue:GetJob or glue:GetJobRun.

s3:PutObject on a bucket that is a verified code-artifact deployment source (Lambda, CodePipeline, CloudFormation) for a compute workload equals modifying that workload's code.

A SageMaker processing job container executes as its RoleArn.

A SageMaker training job container executes as its RoleArn.

SageMaker compute surfaces (notebook/training/processing job/pipeline/Studio app) expose execution-role credentials to all code running inside them via IMDS or the container credentials endpoint.

Custom activities in ADF pipelines (running on Batch pools) can request a bearer token for the factory MI via the Azure IMDS endpoint.

Principal can invoke a batch endpoint to trigger a batch scoring job on the endpoint's compute cluster.

Any code running on an AML compute node can mint the compute MI's token from IMDS - the MI credential is exposed to all job code.

Any code on an AML compute node can mint a bearer token for the compute MI via IMDS.

Write to a compute cluster - changes the compute identity block, SSH keys, subnet, or init scripts.

Principal can trigger an existing AML job/pipeline run, executing the current job definition as the cluster MI.

Modify a pool startTask/config + the pool runs as an MI => execute as that MI (via IMDS).

Submit a data-plane task + the pool runs as an MI => execute as that MI (via IMDS).

Exec into a running replica + the app runs as an MI => execute as that MI (read the identity endpoint from the shell).

Control-plane image/command replacement + the app runs as an MI => execute as that MI (via the identity endpoint).

A cluster with a bound Access Connector MI leaks that MI's credential to any code running on it via IMDS.

Any code on a cluster with a bound MI can mint a bearer token for that MI via IMDS.

A Dataflow worker SA with storage.objects.create on an external GCS bucket can stream pipeline output (data records, query results) to that external location.

Dataflow worker SA credentials accessible via metadata server to code running in pipeline transforms (when execution is established via CanModifyCode or CanExecuteAs).

dataproc.workflowTemplates.instantiate directly runs the workflow template, feeding cicd-chains trigger-then-executes-as.

dataproc.workflowTemplates.update lets the principal modify the job DAG (steps, jars, main class) a workflow template runs as the cluster SA.

A training job or Workbench notebook exposes its runtime SA credentials to any code it runs via the GCE metadata server.