From fceb6b4208c8978f52ea312348ab3fc0f2f13720 Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Fri, 23 Oct 2026 06:02:47 +0200 Subject: [PATCH] Clarify excluded MWAA token role path prerequisites --- ...lected_service_join_final_reaudit_20261016.yaml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/src/privilege-escalation-paths/aws/_excluded_uncollected_service_join_final_reaudit_20261016.yaml b/src/privilege-escalation-paths/aws/_excluded_uncollected_service_join_final_reaudit_20261016.yaml index 7e4e28b220..64b0c7bd29 100644 --- a/src/privilege-escalation-paths/aws/_excluded_uncollected_service_join_final_reaudit_20261016.yaml +++ b/src/privilege-escalation-paths/aws/_excluded_uncollected_service_join_final_reaudit_20261016.yaml @@ -43,15 +43,17 @@ - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mwaa-privesc/README.md#classic-mwaa-airflowcreateweblogintoken--airflowcreateclitoken--code-execution-as-the-environment-execution-role source_revision: b587e6bd26 technique: Mint an Airflow CLI token for an MWAA environment and run code as its execution role - reason: The airflow-env.amazonaws.com resource-to-role attachment is not loaded by the AWS evaluator - (absent from HOST_KIND), so service-role trust cannot identify the exact role reached by the - source action. The attached resource ARN and action coverage cannot be proven. + reason: CreateCliToken grants a CLI session for one MWAA environment, but that session does not + by itself grant the execution role. A principal edge needs the exact environment and role, + reachable web server, Airflow permission to trigger a DAG, and an existing DAG whose executable + code or code-bearing input the source controls. Those Airflow and DAG facts are not collected. prior_id: aws-mwaa-createclitoken-execution-role - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mwaa-privesc/README.md#classic-mwaa-airflowcreateweblogintoken--airflowcreateclitoken--code-execution-as-the-environment-execution-role source_revision: b587e6bd26 technique: Mint an Airflow web-login token for an MWAA environment and run code as its execution role - reason: The airflow-env.amazonaws.com resource-to-role attachment is not loaded by the AWS evaluator - (absent from HOST_KIND), so service-role trust cannot identify the exact role reached by the - source action. The attached resource ARN and action coverage cannot be proven. + reason: CreateWebLoginToken grants a session with a named Airflow RBAC role, not automatic Admin + access or control of the MWAA execution role. A principal edge needs the exact environment and + execution role, reachable web server, sufficient Airflow RBAC rights, and a DAG whose executable + code or code-bearing input the source controls. Those Airflow and DAG facts are not collected. prior_id: aws-mwaa-createweblogintoken-execution-role