Workflow
Step Functions/Logic Apps/Workflows.
class: Messaging
Realizing resources
aws aws
| resource | scope | enumerate | required permissions |
|---|---|---|---|
aws:appflow:flow |
regional | appflow:ListFlows |
appflow:ListFlows |
aws:codepipeline:pipeline |
regional | codepipeline:ListPipelines |
codepipeline:ListPipelines |
aws:datapipeline:pipeline |
regional | datapipeline:ListPipelines |
datapipeline:ListPipelines |
aws:sagemaker:pipeline |
regional | sagemaker:ListPipelines |
sagemaker:ListPipelines |
aws:stepfunctions:state_machine |
regional | states:ListStateMachines |
states:ListStateMachines |
gcp gcp
| resource | scope | enumerate | required permissions |
|---|---|---|---|
gcp:composer:environment |
regional | composer.projects.locations.environments.list |
composer.environments.list |
gcp:datastream:stream |
regional | datastream.projects.locations.streams.list |
datastream.streams.list |
gcp:workflows:workflow |
regional | workflows.projects.locations.workflows.list |
workflows.workflows.list |
azure azure
| resource | scope | enumerate | required permissions |
|---|---|---|---|
azure:logic:workflow |
global | arg:microsoft.logic/workflows |
Microsoft.Logic/workflows/read |
As edge source
As edge target
Exposure sites
aws-accessanalyzer-finding-details-metadataaws-appflow-flow-data-destinationaws-athena-query-result-rowsaws-backup-recovery-point-restored-contentaws-bedrock-runtime-prompt-response-payloadaws-cloudfront-key-value-store-valueaws-cloudtrail-event-data-store-query-resultsaws-cloudtrail-event-request-response-payload
Rules that touch Workflow 42
A CodePipeline BUILD stage action invokes codebuild:StartBuild on the project; the pipeline orchestrates the build trigger.
aws
CanTriggerInject shell commands into an existing pipeline definition and activate it to execute as the resourceRole already bound to that pipeline - no iam:PassRole needed.
aws
CanExecuteAsCreate a pipeline with a ShellCommandActivity injecting attacker commands, pass a privileged role as resourceRole, and activate: the EC2 resource runs attacker code as that role. The classic Data Pipeline PassRole RCE.
aws
CanExecuteAsA firing EventBridge rule invokes its configured target (Lambda, Step Functions, ECS, SQS, another bus, etc.) with the event payload.
aws
CanTriggerkinesis:PutRecord(s) to a stream with an active Lambda ESM triggers the consumer function with an attacker-influenced record payload.
aws
CanTriggerA SageMaker Pipeline execution runs steps as its RoleArn.
aws
ExecutesAsSageMaker compute surfaces (notebook/training/processing job/pipeline/Studio app) expose execution-role credentials to all code running inside them via IMDS or the container credentials endpoint.
StartPipelineExecution directly invokes a SageMaker Pipeline, running its steps as the pipeline's execution role.
aws
CanInvokeUpdatePipeline can also change the pipeline's RoleArn (with PassRole), swapping the execution identity for all future pipeline executions.
UpdatePipeline replacing the pipeline definition injects attacker-controlled step code that runs as the pipeline's execution role.
aws
CanModifyCodestates:UpdateStateMachineAlias / states:CreateStateMachineAlias allows redirecting an alias to a different definition version without triggering visible definition-update alerts.
states:StartExecution or states:StartSyncExecution allows a principal to directly start a state machine execution with an attacker-supplied input payload.
aws
CanInvokestates:StartSyncExecution allows a principal to directly start a synchronous execution of an Express state machine with an attacker-supplied input payload.
aws
CanInvokestates:UpdateStateMachine combined with iam:PassRole on a new role allows swapping the execution role to a different IAM identity on an existing state machine.
A cross-account principal with states:StartExecution on a state machine in another account can directly trigger an execution in that account with an attacker-influenced payload.
aws
CanInvokeModify a state machine's ASL definition (states:UpdateStateMachine), then trigger an execution to run arbitrary AWS SDK Task states as the execution role.
aws
CanExecuteAsDirectly invoke a state machine (states:StartExecution) with an attacker-supplied input payload to execute as the machine's execution role.
aws
CanExecuteAsA state machine exposes its execution role's credentials to any code injected into a Task state (AWS SDK calls are made with the execution role's session).
states:SendTaskSuccess / states:SendTaskFailure with a valid taskToken allows steering an active execution through branching logic or injecting data into downstream Task states.
ADF Copy activity configured with an external or cross-boundary sink (HTTP, public blob, SFTP) can move data outside the authorized boundary.
azure
CanExfiltrateDirectly trigger a pipeline run via pipelines/createRun/action (requires Contributor/Owner or a custom role - NOT Data Factory Contributor).
azure
CanInvokeOverwrite an ADF Data Flow definition to inject attacker transformation logic running on the factory's Spark/IR cluster as the factory MI.
azure
CanModifyCodeAn ADF factory with publicNetworkAccess=Enabled exposes its REST data-plane endpoint (adfstudio.azure.com + management.azure.com) to the internet.
azure
ExposedToInternetOverwrite an ADF pipeline definition to inject arbitrary activities (Web, Custom, Copy) that run as the factory MI.
azure
CanModifyCodeAn ADF Storage Events or Custom Events trigger binds a storage/Event Grid source to a pipeline; writing to that source drives the pipeline run.
azure
CanTriggerA Logic App with a public HTTP (Request) trigger and no IP allowlist is triggerable from the internet.
azure
ExposedToInternetInvoke a Logic App HTTP trigger using a held callback URL (SAS-signed).
azure
CanInvokeA Standard Logic App with a bound MI exposes that MI's credential to any code/action running in the app.
azure
ExposesCredentialCode/actions in a Standard Logic App can mint a bearer token for each bound MI via the App Service identity endpoint.
azure
CanRetrieveTokenA Logic App with a Recurrence trigger fires autonomously on a cadence - creating/modifying it with workflows/write is schedule creation.
azure
CanScheduleOverwrite a Sentinel automation playbook's Logic App definition to inject attacker code that runs as the playbook's managed identity on the next incident trigger.
azure
CanModifyCodeCreate a new Eventarc trigger binding an event source to a destination consumer, then publish an event (or wait for a natural event) to run the consumer as its runtime SA. Provides the Eventarc-specific framing of messaging-chains rule 2.
gcp
CanExecuteAsUpdate an existing Eventarc trigger's destination to point at attacker-controlled or higher-privilege compute, then wait for a natural event to fire, gaining execution as the new destination's runtime SA.
gcp
CanExecuteAsA training job or Workbench notebook exposes its runtime SA credentials to any code it runs via the GCE metadata server.
Update the serviceAccount field to swap the runtime SA of an existing workflow.
eventarc.triggers.create/update lets an attacker bind a new event source (Pub/Sub topic, Audit Log, GCS event) to the workflow - the event-source-binding creation primitive.
gcp
CanScheduleAny code running inside a workflow (via definition control) can exfiltrate the runtime SA token via an outbound http.request step to an attacker-controlled endpoint.
Publishing/sending to an event source triggers the consumer bound to it (via an event-source-mapping/subscription/rule target) with an attacker-influenced payload.
Creating a schedule/rule that invokes a target as a passed execution identity is persistence and yields execution as that identity.
Triggering an event-driven consumer that executes as an identity runs the attacker-influenced payload as that identity (generic messaging case; CI/CD runners are cicd-chains').