GenericIdentity
class: Identity derivation-only - no collection recipe
Realizing resources
This type has no collection recipe - it appears only as the endpoint of derived edges.
As edge source
AuthenticatesToCanAddMemberCanAdministerCanAssumeCanAttachIdentityCanControlCanCreateCanCreateCredentialForCanCreateKeyCanCreateWorkloadAsCanDecryptCanDelegateCanDeleteCanDeleteDataCanDeployCanEnterAccountCanEnterOrganizationCanEnterProjectCanEnterSubscriptionCanEnterTenantCanEscalateToCanExecuteAsCanExecuteCommandCanExecuteOnCanExfiltrateCanExportKeyCanFederateAsCanGrantPermissionCanImpersonateCanInvokeCanModifyCanModifyCodeCanModifyConfigurationCanModifyPolicyCanModifyTrustCanNetworkReachCanPassIdentityCanReadCanReadCredentialCanReadDataCanReadSecretCanRemoveMemberCanReplaceCanResetCredentialCanRetrieveTokenCanScheduleCanSignAsCanStartCanTakeOwnershipCanTriggerCanWriteCanWriteDataControlsExposedToAccountExposedToTenantFederatesToHasPermissionHasPolicyHasRoleLocatedInMemberOfAs edge target
AttachedToAuthenticatesToCanAdministerCanControlCanCreateCanCreateCredentialForCanCreateWorkloadAsCanDelegateCanDeleteCanEscalateToCanExecuteAsCanGrantPermissionCanModifyCanModifyConfigurationCanModifyPolicyCanReadCanReplaceCanResetCredentialCanRetrieveTokenCanTakeOwnershipCanWriteContainsContainsResourceReferenceControlsCredentialValidForCredentialsForExecutesAsExposesCredentialExternalIdentityMapsToFederatesToHasPermissionExposure sites
aws-acm-exported-private-key-outputaws-amplify-webhook-url-outputaws-apigateway-rest-api-key-valueaws-cloudformation-stack-output-valueaws-cloudhsm-extractable-key-material-data-planeaws-codeartifact-authorization-token-outputaws-codebuild-exported-environment-variable-outputaws-codebuild-webhook-secret-output
Rules that touch GenericIdentity 4
opsworks:UpdateUserProfile overwrites an OpsWorks user's SSH public key; OpsWorks propagates it to all stack instances at the next configure event, giving SSH access.
A principal who can reset the root DB user password and then read all data in a Cloud SQL instance has escalated to full DBA-level database privilege.
gcp
CanEscalateTocloudsql.users.update on a Cloud SQL instance lets a principal reset any DB user's password, including root/admin DB users.
A principal that can reset the root/admin DB user password on a Cloud SQL instance gains full SQL read access to all databases in that instance.
gcp
CanReadData