Role
Assumable/assignable bundle of permissions (distinct from the principal that holds it).
class: Identity
Realizing resources
aws aws
| resource | scope | enumerate | required permissions |
|---|---|---|---|
aws:iam:role |
global | iam:ListRoles |
iam:ListRoles |
gcp gcp
| resource | scope | enumerate | required permissions |
|---|---|---|---|
gcp:iam:role |
global | iam.projects.roles.list |
iam.roles.list |
As edge source
AuthenticatesToCanAddMemberCanAdministerCanAssumeCanAttachIdentityCanControlCanCreateCanCreateCredentialForCanCreateKeyCanCreateWorkloadAsCanDecryptCanDelegateCanDeleteCanDeleteDataCanDeployCanEnterAccountCanEnterOrganizationCanEnterProjectCanEnterSubscriptionCanEnterTenantCanEscalateToCanExecuteAsCanExecuteCommandCanExecuteOnCanExfiltrateCanExportKeyCanFederateAsCanGrantPermissionCanImpersonateCanInvokeCanModifyCanModifyCodeCanModifyConfigurationCanModifyPolicyCanModifyTrustCanNetworkReachCanPassIdentityCanReadCanReadCredentialCanReadDataCanReadSecretCanRemoveMemberCanReplaceCanResetCredentialCanRetrieveTokenCanScheduleCanSignAsCanStartCanTakeOwnershipCanTriggerCanWriteCanWriteDataControlsCrossAccountTrustExposedToAccountExposedToTenantFederatesToHasPermissionHasPolicyHasRoleLocatedInMemberOfTrustsExternalIdentityAs edge target
AttachedToAuthenticatesToCanAddMemberCanAdministerCanAssumeCanControlCanCreateCanCreateCredentialForCanCreateWorkloadAsCanDelegateCanDeleteCanEscalateToCanExecuteAsCanFederateAsCanGrantPermissionCanModifyCanModifyConfigurationCanModifyPolicyCanModifyTrustCanPassIdentityCanReadCanRemoveMemberCanReplaceCanResetCredentialCanRetrieveTokenCanTakeOwnershipCanWriteContainsContainsResourceReferenceControlsCredentialValidForCredentialsForExecutesAsExposesCredentialExternalIdentityMapsToFederatesToHasPermissionHasRoleMemberOfExposure sites
aws-acm-exported-private-key-outputaws-amplify-webhook-url-outputaws-apigateway-rest-api-key-valueaws-cloudformation-stack-output-valueaws-cloudhsm-extractable-key-material-data-planeaws-codeartifact-authorization-token-outputaws-codebuild-exported-environment-variable-outputaws-codebuild-webhook-secret-output
Rules that touch Role 76
A management-account principal that can assume OrganizationAccountAccessRole enters the member account as full admin.
aws
CanEnterAccountA stack's service role (Identity) triggers the Custom:: resource Lambda during stack lifecycle events via lambda:InvokeFunction; principals who CanExecuteAs the service role inherit this CanTrigger path.
aws
CanTriggercloudformation:CreateStackInstances / UpdateStackSet in the admin account deploys to target accounts, executing as the StackSet execution role there - a cross-account foothold.
aws
CanEnterAccountCodeDeploy lifecycle hook scripts (running as root on EC2/on-prem targets) can read the instance profile role credentials from IMDS, exposing them to the attacker's code.
Trigger a deployment to execute orchestration-plane actions as the deployment group's service role - requires a run path.
aws
CanExecuteAsA Cognito-authenticated federated identity presents a valid pool token to receive temporary IAM credentials for the authenticated role. When the role trust condition is broad (authenticated but any provider), any authenticated pool user - regardless of the provider used - receives the role.
aws
CanFederateAsAn IAM principal with cognito-identity:GetOpenIdTokenForDeveloperIdentity can synthesize a developer-authenticated token for any developerUserId in the pool and exchange it for the authenticated role's IAM credentials, bypassing user authentication entirely.
aws
CanFederateAsAn Identity Pool role mapping rule selects a privileged IAM role based on a token claim value the pool user can write (e.g. a custom User Pool attribute updatable via UpdateUserAttributes), enabling self-escalation to the mapped role.
aws
CanFederateAsAn Identity Pool with AllowUnauthenticatedIdentities=true lets any internet user call GetId + GetCredentialsForIdentity (no credentials required) to receive temporary IAM credentials for the unauthenticated role.
aws
CanFederateAsconfig:PutRemediationConfigurations + iam:PassRole sets the AutomationAssumeRole on a Config remediation configuration; when triggered, Config invokes SSM Automation as that role, yielding code execution as the passed role.
A management-account principal that can assume AWSControlTowerExecution enters every enrolled member account as administrator.
aws
CanEnterAccountThe Data Pipeline service assumes the pipeline's `role` field to provision compute resources and access downstream AWS services on the pipeline's behalf.
aws
ExecutesAsA pipeline's EC2 or EMR resource node executes as the IAM role in the pipeline's resourceRole field, making that role reachable via IMDS by any code the pipeline runs.
aws
ExecutesAsA pipeline's EC2 or EMR resource node exposes the resourceRole's temporary credentials to any code running in its activities via the IMDS endpoint.
iam:PassRole on a role that trusts datapipeline.amazonaws.com lets the principal bind it as the pipeline role, used by the Data Pipeline service to provision EC2/EMR resources and access downstream AWS services.
aws
CanPassIdentityiam:PassRole on a role that trusts ec2.amazonaws.com lets the principal bind it as the resourceRole in a Data Pipeline definition, enabling code running on the EC2/EMR node to execute as that role.
aws
CanPassIdentityExplicit extraction: the Data Pipeline service assumes the role specified in the role field.
aws
ExecutesAsExplicit extraction: a pipeline's EC2 or EMR resource node runs as the IAM role specified in the resourceRole field.
aws
ExecutesAsAn EventBridge rule assumes its invocation RoleArn (via events.amazonaws.com) to call targets that require IAM authorization; code running as that rule effectively runs as the invocation role.
aws
ExecutesAsAn EventBridge Scheduler schedule assumes its Target.RoleArn (via scheduler.amazonaws.com) at each fire; anyone who can modify the schedule or the role effectively runs as that role on a cadence.
aws
ExecutesAsAn IAM role whose trust policy Federated principal matches an EKS cluster OIDC issuer URL trusts that cluster's projected SA tokens.
A Kubernetes ServiceAccount annotated with eks.amazonaws.com/role-arn and a matching IAM role trust policy (Federated = cluster OIDC issuer) lets any pod running as that KSA exchange its projected token for IAM role credentials via sts:AssumeRoleWithWebIdentity. Cites container-chains workload-identity-federates and federation-chains federation-maps-to-identity.
aws
CanFederateAsPods on EC2 managed nodes with IMDS hop-limit >= 2 can reach 169.254.169.254 and retrieve temporary credentials for the node group IAM role. Any code execution inside such a pod inherits the node role without any IRSA or Pod Identity annotation.
Exec into a running pod (via cluster-admin or direct pods/exec RBAC) inherits the pod's mounted IRSA or Pod Identity token, executing as the pod's IAM role. Cites container-chains cluster-rbac-exec; dedupes on (CanExecuteAs, principal, role).
aws
CanExecuteAsAn EKS Pod Identity Association (eks:CreatePodIdentityAssociation) links a Kubernetes namespace:ServiceAccount pair to an IAM role. Pods running as that SA receive IAM credentials from the eks-pod-identity-agent at 169.254.170.23. Whoever can create or modify this association can reroute which IAM role any pod in that namespace:SA binding runs as.
aws
CanFederateAsAn IAM role whose trust policy Service principal includes pods.eks.amazonaws.com is eligible for EKS Pod Identity associations.
A Kubernetes RBAC subject (user/group/SA) holding pods/exec create verb on a namespace can exec into any pod in that namespace.
Signing with a key that anchors an auth system forges the trusted identity.
aws
CanImpersonateA Lightsail instance with an associated IAM role exposes that role's session via IMDS.
aws
CanRetrieveTokenopsworks:UpdateStack + iam:PassRole on the new service role swaps the identity OpsWorks operates as.
aws
CanModifyTrustopsworks:CloneStack + iam:PassRole on a privileged role lets a principal create a cloned stack running as that role.
aws
CanPassIdentityiam:PassRole for opsworks.amazonaws.com (service role) or ec2.amazonaws.com (instance profile) plus opsworks:CreateStack or opsworks:UpdateStack lets a principal bind a chosen role to a stack.
aws
CanPassIdentityquicksight:RegisterUser + quicksight:UpdateUser (role=ADMIN) lets an attacker promote themselves or others to QuickSight admin, gaining read access to all datasets, dashboards, and data source configurations.
quicksight:UpdateAccountSettings + iam:PassRole (to quicksight.amazonaws.com) lets an attacker swap the QuickSight service role.
aws
CanPassIdentityCreating/updating a Roles Anywhere profile that lists a privileged role (with iam:PassRole) maps the attacker's cert to that role.
aws
CanModifyTrustRegistering an attacker-controlled CA as a trust anchor lets the attacker mint certs that federate into any role trusting the Roles Anywhere service principal.
aws
CanModifyTrustA cert holder whose subject satisfies a Roles Anywhere role trust can CreateSession to obtain that role's temporary credentials.
aws
CanFederateAsCreate a new State Manager association with a privileged role and attacker-controlled document parameters, yielding recurring scheduled code execution as that role.
Create a new Automation document with attacker-controlled steps and bind a passable privileged role, yielding code execution as that role.
A managed instance exposes its instance-profile role credentials to any code running on it via the IMDS endpoint.
Register a Run Command / Automation task with a Maintenance Window, binding a privileged service role that the task will run as.
A principal that can attach a policy to a permission set (via sso:PutInlinePolicyToPermissionSet or sso:AttachManagedPolicyToPermissionSet) widens the effective permissions of every current assignee of that permission set across all assigned accounts.
listKeys/action returns ADLS Gen2 account keys, bypassing all RBAC and ACLs.
azure
CanReadCredentialReading a secret that is a credential for a more-privileged identity is escalation.
azure
CanEscalateToShowing 60. Filter all rules for Role.