From 7221ee89620b702c9e02c265e8c8784b56c1b8f1 Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Fri, 23 Oct 2026 04:19:00 +0200 Subject: [PATCH] Avoid duplicate global gates for three AWS privilege routes --- src/privilege-escalation-paths/aws/cloudcontrol.yaml | 4 ++-- src/privilege-escalation-paths/aws/ec2.yaml | 10 ++++------ 2 files changed, 6 insertions(+), 8 deletions(-) diff --git a/src/privilege-escalation-paths/aws/cloudcontrol.yaml b/src/privilege-escalation-paths/aws/cloudcontrol.yaml index 2226186933..9baf069349 100644 --- a/src/privilege-escalation-paths/aws/cloudcontrol.yaml +++ b/src/privilege-escalation-paths/aws/cloudcontrol.yaml @@ -15,9 +15,9 @@ source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudcontrol-privesc/README.md#cloudformationcreateresource--iampassrole source_revision: 9e5d46375b53cbd2d0cdce63771f3e36f0c30bae summary: The source can use a passable CloudFormation role to create an IAM user with an administrator policy and a chosen console password through Cloud Control. + # The native precondition checks CreateResource, exact PassRole, and the role's user-creation rights. requires: - all_of: - - action: cloudformation:CreateResource + all_of: [] source_kind: [aws_user, aws_role] target: kind: aws_account_admin diff --git a/src/privilege-escalation-paths/aws/ec2.yaml b/src/privilege-escalation-paths/aws/ec2.yaml index 684573e6e3..e64c256bb5 100644 --- a/src/privilege-escalation-paths/aws/ec2.yaml +++ b/src/privilege-escalation-paths/aws/ec2.yaml @@ -15,10 +15,9 @@ source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc/README.md#iampassrole-ec2runinstances source_revision: 171e422299 summary: The source can launch an EC2 instance it controls with a passable instance profile and may run code using the attached role. + # The native precondition checks every launch resource and PassRole on the exact role. requires: - all_of: - - action: iam:PassRole - - action: ec2:RunInstances + all_of: [] target: kind: aws_role selector: @@ -92,10 +91,9 @@ source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc/README.md#ec2requestspotinstances-iampassrole source_revision: 171e422299 summary: The source can request a Spot Instance it controls with a passable instance profile and may run code using the attached role. + # The native precondition checks every Spot request resource and PassRole on the exact role. requires: - all_of: - - action: iam:PassRole - - action: ec2:RequestSpotInstances + all_of: [] target: kind: aws_role selector: