VirtualMachine

Create a deployment with an attacker-controlled revision; hook scripts run as root on every EC2/on-prem instance in the deployment group, yielding fleet-wide command execution.

CodeDeploy lifecycle hook scripts (running as root on EC2/on-prem targets) can read the instance profile role credentials from IMDS, exposing them to the attacker's code.

A pipeline's EC2 or EMR resource node exposes the resourceRole's temporary credentials to any code running in its activities via the IMDS endpoint.

A volume is attached to an EC2 instance via ec2:DescribeVolumes.

Run code on an instance that ExecutesAs a role -> execute as that role.

Pods on EC2 managed nodes with IMDS hop-limit >= 2 can reach 169.254.169.254 and retrieve temporary credentials for the node group IAM role. Any code execution inside such a pod inherits the node role without any IRSA or Pod Identity annotation.

Inject an SSH public key into a running Glue development endpoint via glue:UpdateDevEndpoint, gaining OS-level command execution on the Spark cluster host.

OS access to a Lightsail instance -> read IMDS -> act as the associated role.

A Lightsail instance with an associated IAM role exposes that role's session via IMDS.

opsworks:CreateDeployment grants ability to run arbitrary Chef recipes or commands on stack instances (execute_recipes / run_command).

opsworks:UpdateApp lets a principal change an app's source repository, enabling application supply-chain injection.

opsworks:CreateDeployment can trigger a deployment run using the stack's current cookbook/app definition.

opsworks:CreateDeployment lets a principal run arbitrary Chef recipes or commands on stack instances as the instance profile role.

opsworks:CreateDeployment (non-execute_recipes flavors) triggers a deployment with the stack's current cookbook definition - CanTrigger into the instance for cicd-chains rule 2.

OpsWorks-managed EC2 instance runs as its IAM instance profile role.

An OpsWorks-managed EC2 instance exposes its instance profile role credentials to any code that runs on it (via IMDS).

opsworks:UpdateStack can redirect the custom cookbook source to an attacker-controlled repo, making all future cookbook deployments run attacker code as the instance profile role.

opsworks:UpdateUserProfile overwrites an OpsWorks user's SSH public key; OpsWorks propagates it to all stack instances at the next configure event, giving SSH access.

A State Manager association with a cron schedule triggers the bound document against targeted instances automatically.

A principal in account A that can execute commands on an instance in account B, which runs as a role in account B, gains a foothold in account B.

A managed instance exposes its instance-profile role credentials to any code running on it via the IMDS endpoint.

ssm:SendCommand delivers attacker-controlled commands to a managed instance, yielding OS-level execution as root/SYSTEM.

ssm:StartSession opens an interactive WebSocket shell to a managed instance, bypassing firewall rules.

ssm:UpdateAssociation changes the document or command parameters of a State Manager association, injecting attacker code into the managed instances the association targets.

An available Interface VPC Endpoint (PrivateLink) makes the backing AWS or third-party service reachable from compute within the VPC via private networking, without traversing the public internet. Source is any Compute node in the VPC that has network access to the endpoint ENI.

An available Interface VPC Endpoint (PrivateLink) makes the backing AWS or third-party service reachable from compute within the VPC via private networking, without traversing the public internet. Derived from the endpoint state and VPC co-location facts.

A compute resource is internet-exposed when its security group has an inbound rule allowing 0.0.0.0/0 (or ::/0) on a port, the resource has a public IP, and the subnet has a route to an Internet Gateway. All three conditions must be observed facts.

A Self-Hosted IR node VM stores encrypted linked service credentials in its local credential store; OS-level access to the node decrypts them.

Node-level code execution (privileged pod, hostPID, DaemonSet exec) reaches the node IMDS and mints a token for the node system-assigned / kubelet MI.

Any code running on an AML compute node can mint the compute MI's token from IMDS - the MI credential is exposed to all job code.

Any code on an AML compute node can mint a bearer token for the compute MI via IMDS.

Write access to a compute instance can modify SSH public key configuration and other network settings.

SSH access to a running compute instance when SSH is enabled and the principal controls the SSH private key.

Submit a runbook job targeting a Hybrid Runbook Worker Group; the runbook runs as LOCAL SYSTEM (or a stored credential) on the designated VM/on-prem host.

A self-hosted pipeline agent (VirtualMachine) runs as its OS user / managed identity, providing a second execution identity for all pipelines on that agent.

Attach a privileged user-assigned MI to an existing VM the caller can run code on, then execute as that MI via IMDS.

Command/code execution on a VM + the VM runs as an MI => execute as that MI (via IMDS).

Modify the buildspec/pipeline/runbook/template a runner executes, then run it, to execute as the runner's service identity.

Triggering a pipeline reaches each downstream stage runner it orchestrates; propagate CanTrigger to those runners.

Trigger/start a runner whose current definition already runs attacker-influenced code, executing as the runner's identity.

A VM whose source IP falls within a Filestore NFS export range can mount the share and read (and write, if READ_WRITE) all files without any IAM check - access is purely IP-address gated. CanWriteData is emitted when accessMode is READ_WRITE; CanReadData for both READ_WRITE and READ_ONLY.

Ingress ALLOW from 0.0.0.0/0 on a port means any internet source can reach that port on matched VMs - a per-firewall-rule network FACT.

VM with an ingress ALLOW from 0.0.0.0/0 AND an external IP is internet-exposed on that port - any unauthenticated actor can attempt to connect.

A principal with iap.tunnelInstances.accessViaIAP can open a TCP tunnel through Google IAP to any port on the target GCE instance (SSH/22, RDP/3389, or any custom TCP port) without the instance having a public IP. This provides direct network-level reach to a private VM from any location with HTTPS access to Google's infrastructure.

Pushing/overwriting an image in a registry poisons every workload that pulls it - code control propagates from the registry to each consuming Compute/KubernetesWorkload.

A workload poisoned via a registry image push runs as its identity, so the pusher executes as that identity.