GenericCompute

Redirect a Bedrock Agent action group's backing Lambda to an attacker-controlled Lambda, injecting code into the agent's execution path.

Swap a Bedrock Agent's execution role via UpdateAgent+PassRole to execute the orchestration loop as an attacker-chosen role.

cloudformation:CreateStackSet/UpdateStackSet with SERVICE_MANAGED permission model (Organizations integration) deploys to all Org member accounts - equivalent to organization-wide foothold.

kafkaconnect:UpdateConnector with a new custom plugin revision replaces the connector's executable code, enabling arbitrary code execution as its service execution role.

kafkaconnect:UpdateConnector modifies connector task count, settings (topic routing, downstream endpoint, embedded credentials), and capacity - configuration changes with security-relevant side effects.

An MSK Connect connector's configuration (readable via kafkaconnect:DescribeConnector) may contain embedded credentials for downstream data stores (JDBC passwords, S3 keys, API credentials).

An MSK Connect connector runs its plugin code as the configured IAM service execution role.

An MSK Connect connector exposes its service execution role credentials to all plugin code running within it via the ECS task-credential endpoint.

An MSK Replicator reading from a source cluster with kafka-cluster:ReadData permission enables cross-cluster/cross-account data exfiltration of message contents.

A SageMaker Model executes as its ExecutionRoleArn at serving (endpoint) and batch-transform time.

UpdateDomain changes the default execution role for all new Studio apps in the domain.

UpdateUserProfile changes the execution role for a specific Studio user profile.

states:UpdateStateMachine allows replacing the ASL definition with arbitrary Task states that call AWS services as the execution role - equivalent to a buildspec rewrite.

An EventBridge rule with a Step Functions state machine as its target can start an execution when the rule matches; the EventBridge source is the event source, the state machine is the consumer.

A Step Functions state machine runs every execution as its configured IAM execution role.

An available Interface VPC Endpoint (PrivateLink) makes the backing AWS or third-party service reachable from compute within the VPC via private networking, without traversing the public internet. Source is any Compute node in the VPC that has network access to the endpoint ENI.

An available Interface VPC Endpoint (PrivateLink) makes the backing AWS or third-party service reachable from compute within the VPC via private networking, without traversing the public internet. Derived from the endpoint state and VPC co-location facts.

A compute resource is internet-exposed when its security group has an inbound rule allowing 0.0.0.0/0 (or ::/0) on a port, the resource has a public IP, and the subnet has a route to an Internet Gateway. All three conditions must be observed facts.

Modify the identity block of an Automation Account via automationAccounts/write; enables identity swap (CanAttachIdentity-like escalation).

Attach a user-assigned managed identity to an Automation Account (Azure PassRole analog); subsequent runbooks execute as that MI.

Modify or replace Automation Account connections, including legacy RunAs service principal credentials.

Attach a privileged managed identity to a new or existing Automation Account and trigger a runbook - equivalent to creating a new workload bound to that identity.

An Automation Account sandbox job executes as the bound managed identity; any code running in the sandbox can mint MI tokens from IMDS.

An Automation Account sandbox job exposes its bound MI's token to any code it runs via the IMDS endpoint.

An Automation Account with a legacy RunAs account exposes the RunAs service principal certificate to any runbook via Get-AutomationConnection.

Submit a runbook job targeting a Hybrid Runbook Worker Group; the runbook runs as LOCAL SYSTEM (or a stored credential) on the designated VM/on-prem host.

Start a runbook job in an Automation Account (cloud sandbox or hybrid worker).

Upload a malicious PowerShell module or Python package to an Automation Account; existing runbooks that Import-Module/import it execute the injected code as the account MI.

Overwrite or create a runbook (PowerShell/Python) in an Automation Account; content executes as the account MI on next job.

Repoint the Automation Account's source control sync to an attacker-controlled repository; runbook code is replaced at next sync.

Write plaintext Automation Variables that runbooks read; enables behavior modification or credential injection into the execution sandbox.

An enabled Automation Account webhook with a public URI is internet-triggerable; any holder of the URI can start a runbook job.

Holder of a webhook URI (secret token in URL) can trigger a specific runbook job via HTTP POST without ARM RBAC.

Create a new webhook for any runbook via automationAccounts/webhooks/write; the attacker receives the webhook URI once and can trigger the runbook.

A cluster with a bound Access Connector MI leaks that MI's credential to any code running on it via IMDS.

Any code on a cluster with a bound MI can mint a bearer token for that MI via IMDS.

integrationRuntimes/write allows creating or updating integration runtimes; self-hosted IR configuration can point to attacker-controlled infrastructure, causing all pipeline activities routed through that IR to execute on attacker infrastructure.

All Dataproc nodes in a Data Fusion pipeline cluster can retrieve OAuth tokens for the dataprocServiceAccount from the GCE metadata server; code execution in any pipeline step yields those credentials.

datafusion.instances.update (GCP IAM) + CDAP pipeline write access lets a principal deploy or replace a pipeline definition, injecting arbitrary code executed as the instance's dataprocServiceAccount on an ephemeral Dataproc cluster.

A Cloud Tasks queue with httpTarget.uri (or an App Engine target) dispatches tasks to its configured consumer HTTP endpoint - the event-source binding fact consumed by messaging-chains rule 1.