HumanIdentity
Interactive user backed by a human (console/SSO login).
class: Identity
Realizing resources
aws aws
| resource | scope | enumerate | required permissions |
|---|---|---|---|
aws:iam:user |
global | iam:ListUsers |
iam:ListUsers |
azure azure
| resource | scope | enumerate | required permissions |
|---|---|---|---|
azure:entra:user |
global | msgraph:users.list |
User.Read.All |
As edge source
AuthenticatesToCanAddMemberCanAdministerCanAssumeCanAttachIdentityCanControlCanCreateCanCreateCredentialForCanCreateKeyCanCreateWorkloadAsCanDecryptCanDelegateCanDeleteCanDeleteDataCanDeployCanEnterAccountCanEnterOrganizationCanEnterProjectCanEnterSubscriptionCanEnterTenantCanEscalateToCanExecuteAsCanExecuteCommandCanExecuteOnCanExfiltrateCanExportKeyCanFederateAsCanGrantPermissionCanImpersonateCanInvokeCanModifyCanModifyCodeCanModifyConfigurationCanModifyPolicyCanModifyTrustCanNetworkReachCanPassIdentityCanReadCanReadCredentialCanReadDataCanReadSecretCanRemoveMemberCanReplaceCanResetCredentialCanRetrieveTokenCanScheduleCanSignAsCanStartCanTakeOwnershipCanTriggerCanWriteCanWriteDataControlsExposedToAccountExposedToTenantFederatesToHasPermissionHasPolicyHasRoleLocatedInMemberOfAs edge target
AttachedToAuthenticatesToCanAdministerCanControlCanCreateCanCreateCredentialForCanCreateWorkloadAsCanDelegateCanDeleteCanEscalateToCanExecuteAsCanGrantPermissionCanModifyCanModifyConfigurationCanModifyPolicyCanReadCanReplaceCanResetCredentialCanRetrieveTokenCanTakeOwnershipCanWriteContainsContainsResourceReferenceControlsCredentialValidForCredentialsForExecutesAsExposesCredentialExternalIdentityMapsToFederatesToHasPermissionExposure sites
aws-acm-exported-private-key-outputaws-amplify-webhook-url-outputaws-apigateway-rest-api-key-valueaws-cloudformation-stack-output-valueaws-cloudhsm-extractable-key-material-data-planeaws-codeartifact-authorization-token-outputaws-codebuild-exported-environment-variable-outputaws-codebuild-webhook-secret-output
Rules that touch HumanIdentity 20
An IAM principal with cognito-identity:GetOpenIdTokenForDeveloperIdentity can synthesize a developer-authenticated token for any developerUserId in the pool and exchange it for the authenticated role's IAM credentials, bypassing user authentication entirely.
aws
CanFederateAsResetting the password of a domain-admin directory user yields privilege escalation to domain-admin access over all domain-joined resources.
aws
CanEscalateToopsworks:UpdateUserProfile overwrites an OpsWorks user's SSH public key; OpsWorks propagates it to all stack instances at the next configure event, giving SSH access.
User Administrator role in B2C tenant can reset B2C consumer account passwords, enabling account takeover.
azure
CanResetCredentialA principal that can CanExecuteAs the pipeline's service-connection identity, where that identity holds ARM Contributor/Owner at subscription scope, gains a foothold in that Azure subscription.
azure
CanEnterSubscriptionA service principal holding User.ReadWrite.All (or Directory.ReadWrite.All) can reset any non-protected Entra user's password via PATCH /users/{id} with a new passwordProfile, taking over that user's account and inheriting their RBAC and group memberships.
azure
CanResetCredentialWorkspace super-admin can authorize any service account for Domain-Wide Delegation (adding its OAuth2 client ID to the delegated clients list with chosen scopes), creating a new tenant-wide impersonation primitive.
gcp
CanModifyTrustWorkspace delegated admin (or super-admin) with the USER_MANAGEMENT / password-reset privilege can reset any non-admin user's password, hijacking their account.
A DWD SA with both admin-directory and cloud-platform scopes can act as a super-admin and thereby obtain GCP Organization-level control.
Workspace super-admin can grant any GCP IAM role to any principal in the linked GCP organization, equivalent to resourcemanager.organizations.setIamPolicy.