Notebook
Managed notebook (SageMaker/AzureML/Vertex).
class: Compute
Realizing resources
aws aws
| resource | scope | enumerate | required permissions |
|---|---|---|---|
aws:sagemaker:notebook-instance |
regional | sagemaker:ListNotebookInstances |
sagemaker:ListNotebookInstances |
gcp gcp
| resource | scope | enumerate | required permissions |
|---|---|---|---|
gcp:aiplatform:notebook |
regional | notebooks.projects.locations.instances.list |
notebooks.instances.list |
As edge source
CanDecryptCanDeleteDataCanExfiltrateCanNetworkReachCanReachPortCanReadCredentialCanReadDataCanReadSecretCanRetrieveTokenCanWriteDataContainsCredentialContainsResourceReferenceContainsSecretExecutesAsExposedToAccountExposedToInternetExposedToTenantExposesCredentialHasPolicyLocatedInPrivateReachabilityAs edge target
AttachedToAuthenticatesToCanAdministerCanAttachIdentityCanControlCanCreateCanDeleteCanDeployCanExecuteCommandCanExecuteOnCanModifyCanModifyCodeCanModifyConfigurationCanModifyPolicyCanNetworkReachCanReachPortCanReadCanReplaceCanStartCanTakeOwnershipCanTriggerCanWriteContainsContainsResourceReferenceControlsHasPermissionPrivateReachabilityExposure sites
None.
Rules that touch Notebook 17
Update a Glue job's ScriptLocation to an attacker-controlled S3 object, establishing the code-modify and trigger facts needed for can-execute-as derivation.
A SageMaker notebook instance executes kernel code as its RoleArn (execution role).
aws
ExecutesAsA SageMaker Studio App (JupyterServer/KernelGateway) executes as the UserProfile's ExecutionRole.
aws
ExecutesAsSageMaker compute surfaces (notebook/training/processing job/pipeline/Studio app) expose execution-role credentials to all code running inside them via IMDS or the container credentials endpoint.
CreatePresignedDomainUrl opens a Studio session as the specified user profile's execution role - no iam:PassRole required.
aws
CanExecuteAsCreatePresignedNotebookInstanceUrl opens a browser-based Jupyter shell on a running notebook, giving the caller immediate code execution as the notebook's execution role - no iam:PassRole required.
aws
CanExecuteAsUpdateNotebookInstance changes notebook configuration including RoleArn (with PassRole), instance type, subnet, and security groups.
UpdateNotebookInstance changing the lifecycle config injects a shell script that runs as root on next start, within the notebook's execution role context.
aws
CanModifyCodeAny code running on an AML compute node can mint the compute MI's token from IMDS - the MI credential is exposed to all job code.
azure
ExposesCredentialAny code on an AML compute node can mint a bearer token for the compute MI via IMDS.
azure
CanRetrieveTokenCAN_MANAGE on a notebook path allows overwriting notebook code via import/overwrite; runs as the cluster MI on next execution.
azure
CanModifyCodeWorkbench notebook instance explicitly declares its service account.
gcp
ExecutesAsPrincipal can modify Workbench instance startup or post-startup script via notebooks.instances.update.
gcp
CanModifyCodePrincipal holds notebooks.instances.update or notebooks.instances.updateConfig on a Workbench instance.
Principal holds notebooks.instances.use on a Workbench instance (explicit permission normalization).
A training job or Workbench notebook exposes its runtime SA credentials to any code it runs via the GCE metadata server.
Update a Workbench instance's service account (notebooks.instances.update + actAs on new SA) so future code runs as the new SA.