Skip to content

Clarify MWAA token route exclusion evidence #504

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
carlospolop merged 1 commit into from
Oct 23, 2026
Merged

Clarify MWAA token route exclusion evidence #504

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 8 additions & 6 deletions ...ilege-escalation-paths/aws/_excluded_uncollected_service_join_final_reaudit_20261016.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,15 +43,17 @@
- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mwaa-privesc/README.md#classic-mwaa-airflowcreateweblogintoken--airflowcreateclitoken--code-execution-as-the-environment-execution-role
source_revision: b587e6bd26
technique: Mint an Airflow CLI token for an MWAA environment and run code as its execution role
reason: The airflow-env.amazonaws.com resource-to-role attachment is not loaded by the AWS evaluator
(absent from HOST_KIND), so service-role trust cannot identify the exact role reached by the
source action. The attached resource ARN and action coverage cannot be proven.
reason: CreateCliToken grants a CLI session for one MWAA environment, but that session does not
by itself grant the execution role. A principal edge needs the exact environment and role,
reachable web server, Airflow permission to trigger a DAG, and an existing DAG whose executable
code or code-bearing input the source controls. Those Airflow and DAG facts are not collected.
prior_id: aws-mwaa-createclitoken-execution-role
- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mwaa-privesc/README.md#classic-mwaa-airflowcreateweblogintoken--airflowcreateclitoken--code-execution-as-the-environment-execution-role
source_revision: b587e6bd26
technique: Mint an Airflow web-login token for an MWAA environment and run code as its execution
role
reason: The airflow-env.amazonaws.com resource-to-role attachment is not loaded by the AWS evaluator
(absent from HOST_KIND), so service-role trust cannot identify the exact role reached by the
source action. The attached resource ARN and action coverage cannot be proven.
reason: CreateWebLoginToken grants a session with a named Airflow RBAC role, not automatic Admin
access or control of the MWAA execution role. A principal edge needs the exact environment and
execution role, reachable web server, sufficient Airflow RBAC rights, and a DAG whose executable
code or code-bearing input the source controls. Those Airflow and DAG facts are not collected.
prior_id: aws-mwaa-createweblogintoken-execution-role
Loading