ResourcePolicy

Cross-account issuance on a CA whose certs are trusted in the owner account enters that account.

A REST API resource policy with Principal '*' and no VPC/IP restriction makes the API internet-callable.

Deleting the CodeArtifact domain resource policy removes all access controls and opens the publish surface to all principals with domain access - CanModifyPolicy via deletion.

Deleting a CodeArtifact repository resource policy removes all access controls and opens the publish surface for that repository - CanModifyPolicy via deletion.

A CodeArtifact domain resource policy that names a principal in another account creates a CrossAccountTrust that, combined with that principal's identity-policy grants, enables cross-account package publishing into this domain.

Rewriting the CodeArtifact domain resource policy can grant arbitrary principals publish access to all repositories in the domain - CanModifyPolicy over the domain policy node.

Rewriting a CodeArtifact repository resource policy can grant arbitrary principals publish access to that repository - CanModifyPolicy over the repository policy node.

A CodeArtifact repository resource policy that names a principal in another account creates a CrossAccountTrust enabling cross-account package reads or writes to that repository.

An EventBridge custom bus resource policy granting events:PutEvents to a principal in another account establishes cross-account publish trust; the external principal can inject events that trigger compute consumers in this account.

An EventBridge custom bus policy granting events:PutEvents to Principal '*' is publicly writable; any internet actor can inject events and potentially trigger compute consumers.

events:PutPermission allows a principal to rewrite a custom bus resource policy, injecting cross-account trust or public access.

A repository resource policy grants ecr:PutImage to a principal in another AWS account, creating a cross-account supply-chain push trust.

An external principal granted ecr:PutImage via the repository's resource policy can push images (cross-account supply-chain attack).

A principal with ecr:DeleteRepositoryPolicy can delete the repository resource policy, removing all access controls and cross-account restrictions - policy-mutation escalation.

A registry-level replication policy allows an external account's repository to replicate images into the victim's registry, enabling cross-account supply-chain poisoning via the replication mechanism.

A principal with ecr:SetRepositoryPolicy can rewrite the repository resource policy to grant itself or any other principal push or pull access - policy-mutation escalation prerequisite.

An EFS file system policy granting ClientMount to a principal from another AWS account creates a cross-account NFS data path.

A principal with elasticfilesystem:PutFileSystemPolicy can self-grant ClientMount and read all file data on the EFS file system.

A principal with elasticfilesystem:PutFileSystemPolicy can self-grant ClientWrite and write all file data on the EFS file system.

A backup's resource policy (via fsx:GetResourcePolicy) grants fsx:CopyBackup to a principal in a different AWS account, establishing a cross-account trust on the backup resource.

An identity with fsx:PutResourcePolicy on an FSx backup can rewrite the backup's resource policy to grant an external account fsx:CopyBackup access, staging a cross-account backup exfil without touching the live file system.

A Kinesis stream resource policy granting kinesis:PutRecord(s) to a principal in another account is cross-account publish trust, enabling that external principal to trigger the stream's Lambda consumer.

A Kinesis stream resource policy granting read actions (GetRecords/GetShardIterator/SubscribeToShard) to a foreign account enables that account to read the stream's records, supporting data exfiltration.

An external principal permitted by the key policy/grant can use the key cross-account.

An LF admin (or GRANT OPTION holder) granting Lake Formation SELECT / INSERT / DATA_LOCATION_ACCESS to a principal ARN in a foreign AWS account creates cross- account data-lake trust: the external principal can query this account's governed data via their own analytics services.

An MSK cluster resource-based policy granting kafka-cluster:WriteData or ReadData to a principal in another account is cross-account publish/consume trust; feeds messaging-chains rule 4 and can-control's CanEnterAccount derivation.

kafka:PutClusterPolicy allows writing the MSK cluster resource-based policy, enabling the attacker to grant kafka-cluster:WriteData (or ReadData) to arbitrary principals including cross-account ones.

Domain access policy grants es:ESHttp* to a principal in a foreign AWS account, enabling cross-account data access without a role assumption.

A RAM share whose principal is the organization root (o-*) exposes the shared resource to every current and future member account in the organization - ExposedToTenant.

A shared subnet collapses the inter-account network boundary: consumer workloads launched into the shared subnet are on-link with owner-account resources, yielding on-subnet network reachability.

A shared Transit Gateway enables the consumer VPC to reach owner-account resources attached to the TGW, derived from the CrossAccountTrust fact and confirmed TGW attachments.

A principal in account B provisioning a product from a portfolio shared by account A (servicecatalog:ProvisionProduct) causes resources to be deployed in account A as the account-A launch role. The receiving-account principal effectively gains a foothold in account A via the launch role's permissions.

sns:SetTopicAttributes (Policy attribute) or sns:AddPermission rewrites or extends the SNS topic access policy, enabling self-grant of Publish/Subscribe or cross-account trust.

An SNS topic without a DataProtectionPolicy may carry messages embedding secrets; any subscriber can read them (POTENTIAL - content heuristic, not confirmed).

An SNS topic access policy granting sns:Publish to Principal '*' is internet-accessible - anyone can publish and trigger all subscribers.

A queue resource policy granting sqs:SendMessage to a principal in another account is cross-account publish trust; fed by messaging-chains rule 4 to derive CanEnterAccount.

sqs:SetQueueAttributes allows rewriting the queue resource policy (Policy attribute), enabling self-grant of sqs:SendMessage and the downstream trigger chain.

A consumer-account VPC with a confirmed (state==available) attachment to an owner-account Transit Gateway has L3 network reachability to subnets in the owner account (subject to TGW route table routing and L4 security group evaluation). This is a network-layer foothold (CanNetworkReach), not control-plane account entry (CanEnterAccount).

A VPC endpoint policy (gateway or interface) granting access to principals in another AWS account enables cross-account access to the backing PaaS service via the endpoint path. The endpoint policy resource is the trust artifact (modeled as ResourcePolicy source).

vpc-lattice:PutAuthPolicy lets a principal replace the auth policy on a service or service network, potentially opening services to unauthorized callers (remove org restriction, set Principal:*, disable auth type).

scopeMaps/write allows a principal to modify repository-scoped token access policies, upgrading restricted tokens to include push/write capability.

An Event Grid topic exposes its access key to any principal who can call listKeys/action; the key is a long-lived publish credential for the topic.

A customer principal with Microsoft.ManagedServices/registrationAssignments/write can create/modify Lighthouse registrationAssignments - enable cross-tenant access.

An identity with <resource>/privateEndpointConnections/write on a PaaS resource can approve a private endpoint connection from a different subscription. Approving such a connection records a cross-subscription trust: the resource owner has explicitly authorized a network connection from another subscription's VNet, extending the reach of that remote VNet across the subscription boundary.

An Approved private endpoint connection from a different subscription records an authorization relationship: the resource owner (in the provider subscription) has approved a network connection from an external (consumer) subscription. This models the cross-subscription trust relationship established by the approval.

A Service Bus namespace with active SAS authorization rules embeds connection-string credentials usable at data-plane without Entra RBAC.