Record AWS exclusion source lineage and clarify two routes

src/privilege-escalation-paths/aws/_excluded_app_plane_subject_strict_reaudit_20261016.yaml

@@ -6,6 +6,7 @@
     it controls and can sign into is joined to that change.
   prior_id: aws-connect-security-profile-admin
 - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-managed-grafana-privesc/README.md#grafanaupdatepermissions--iam-identity-center-administrator
+  historical_source: src/pentesting-cloud/aws-security/aws-persistence/aws-managed-grafana-persistence/README.md#grafanaupdatepermissions--iam-identity-center-administrator
   source_revision: b587e6bd26
   technique: Grant a controlled Identity Center identity Grafana administrator access
   reason: UpdatePermissions can grant ADMIN to an Identity Center identity, but the

src/privilege-escalation-paths/aws/_excluded_bounded_service_role_overclaim_20261016.yaml

@@ -36,6 +36,7 @@
   reason: Attaching a role to a Redshift warehouse yields only SQL integration operations, not the full IAM role
     session or permissions.
 - source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation/README.md#s3createjob-s3-batch-operations-iampassrole--mass-copyexposelock-a-whole-bucket-as-a-passed-role
+  historical_source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-s3-privesc/README.md#s3createjob-s3-batch-operations-iampassrole--mass-copyexposelock-a-whole-bucket-as-a-passed-role
   technique: aws-s3-batchoperations-passrole-createjob
   reason: S3 Batch Operations executes a bounded S3/Lambda job. The source does not gain general access to the passed
     role.

src/privilege-escalation-paths/aws/_excluded_consumer_input_join_strict_reaudit_20261016.yaml

@@ -24,6 +24,7 @@
     gain.'
   prior_id: aws-appstream-updateapplication-elastic-fleet
 - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sagemaker-privesc/README.md#sagemaker-model-registry-supply-chain-injection-via-createmodelpackageapproved
+  historical_source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sagemaker-post-exploitation/README.md#sagemaker-model-registry-supply-chain-injection-via-createmodelpackageapproved
   source_revision: b587e6bd26
   technique: Register an Approved model version in a Model Package Group consumed by auto-deploy
     automation

src/privilege-escalation-paths/aws/_excluded_consumer_semantics_strict_reaudit_20261016.yaml

@@ -20,6 +20,7 @@
     poisoning only.
   prior_id: aws-codebuild-env-secretsmanager-poisoning
 - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc/README.md#replace-the-root-volume-of-an-existing-role-bearing-ec2-instance
+  historical_source: src/pentesting-cloud/aws-security/aws-persistence/aws-ec2-replace-root-volume-persistence/README.md#ec2
   source_revision: b587e6bd26
   technique: Replace the root volume of an existing role-bearing EC2 instance
   reason: CreateReplaceRootVolumeTask does not prove the source controls a compatible replacement

src/privilege-escalation-paths/aws/_excluded_eks_strict_reaudit_20261016.yaml

@@ -36,6 +36,7 @@
     only a condition.
   prior_id: aws-eks-passrole-createnodegroup
 - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-eks-privesc/README.md#eksassociateidentityproviderconfig-with-a-matching-privileged-rbac-group
+  historical_source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-eks-post-exploitation/README.md#eksassociateidentityproviderconfig-with-a-matching-privileged-rbac-group
   source_revision: b587e6bd26
   technique: Associate an attacker-controlled OIDC identity provider with an EKS cluster
     that binds a privileged RBAC group

src/privilege-escalation-paths/aws/_excluded_execution_foothold_strict_reaudit_20261016.yaml

@@ -13,6 +13,7 @@
     placement and host access are only prose conditions.
   prior_id: aws-ecs-registercontainerinstance-scheduled-tasks
 - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecs-privesc/README.md#steer-replacement-service-tasks-to-an-attacker-controlled-container-instance
+  historical_source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecs-post-exploitation/README.md#steer-replacement-service-tasks-to-an-attacker-controlled-container-instance
   source_revision: b587e6bd26
   technique: Drain or deregister legitimate container instances so service tasks are replaced
     onto a controlled instance

src/privilege-escalation-paths/aws/_excluded_generated_scope_20261016.yaml

@@ -84,12 +84,14 @@
     chain. Reauthor the exact source action, resource, credential subject and effective added permissions before
     restoring.'
 - source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-timestream-post-exploitation/README.md#timestreamexecutescheduledquery--trigger-an-already-stored-role-workflow
+  historical_source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-timestream-privesc/README.md#timestreamexecutescheduledquery--trigger-an-already-stored-role-workflow
   source_revision: 0d0ea06005
   technique: aws-audit-trigger-stored-query-that-delivers-restricted-secrets
-  reason: 'Trigger stored query that delivers restricted secrets: no source IAM action or resource is declared in
-    requires. The conditional aws_role target relies on opaque evidence, so the YAML cannot prove Alice''s permission-to-action-to-subject
-    chain. Reauthor the exact source action, resource, credential subject and effective added permissions before
-    restoring.'
+  reason: ExecuteScheduledQuery runs only the stored SQL of an exact existing scheduled query with its
+    stored role and destinations. The caller may choose InvocationTime but cannot replace the SQL,
+    role, target or notification in that call. The operation returns no role credentials or new IAM
+    permission. A principal edge would need a separately proven downstream credential or permission
+    effect under source control, which is not collected.
 - source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-appsync-post-exploitation/README.md#read-environment-secrets-and-export-the-schema
   technique: aws-audit2-appsync-2
   reason: 'Read environment secrets and export the schema: no source IAM action or resource is declared in requires.
@@ -480,6 +482,7 @@
     alone proves only an application session or incomplete AWS credential. Require actual
     unredacted secret material, validity and principal attribution before an IAM edge.'
 - source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-timestream-post-exploitation/README.md#timestreamcreatescheduledquery--iampassrole--run-sql-and-downstream-writes-as-a-scheduled-query-role
+  historical_source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-timestream-privesc/README.md#timestreamcreatescheduledquery--iampassrole--run-sql-and-downstream-writes-as-a-scheduled-query-role
   source_revision: 0d0ea06005
   technique: aws-audit-create-scheduled-query-to-exfiltrate-role-readable-secrets
   reason: 'Create scheduled query to exfiltrate role-readable secrets: the modeled target is terminal aws_verified_authority/bounded_authority,
@@ -841,6 +844,7 @@
     for WorkSpaces Secure Browser access, but the portal login is not an IAM role session. The page does
     not identify an exact AWS principal gained by the source.'
 - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iot-sitewise-privesc/README.md#grant-yourself-access-to-a-legacy-sitewise-monitor-portal
+  historical_source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iot-sitewise-post-exploitation/README.md#grant-yourself-access-to-a-legacy-sitewise-monitor-portal
   technique: aws-v3-19-grant-a-controlled-identity-sitewise-monitor-administra
   reason: Only the exact self-admin grant on one existing portal with reviewed before/after access is active as aws-sitewise-createaccesspolicy-portal-self-grant. The legacy controlled-other-identity target lacks a typed source-control join and remains excluded.
   source_revision: d11f0e7012

src/privilege-escalation-paths/aws/_excluded_generic_challenge_strict_reaudit_20261016.yaml

@@ -1,5 +1,6 @@
 # Exact originals: docs/privesc-ledgers/aws-scope-archive-20261016/generic-challenge-strict-re-audit.yaml.txt.
 - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/README.md#change-cdktoolkit-trustedaccounts-to-attacker-account-and-deploy-role-trust
+  historical_source: src/pentesting-cloud/aws-security/aws-persistence/aws-cloudformation-persistence/README.md#cdk-bootstrap-stack
   source_revision: b587e6bd26
   technique: Change CDKToolkit TrustedAccounts to attacker account and deploy role trust
   reason: CloudFormation stack update can alter a bootstrap trust list, but the source is not

src/privilege-escalation-paths/aws/_excluded_org_scope_overclaim_20261016.yaml

@@ -5,6 +5,7 @@
     lacks exact evidence that the target account has no MFA barrier or a usable recovery path, so root/account-admin
     access is not established.
 - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-organizations-prinvesc/README.md#organizationsregisterdelegatedadministrator--delegate-a-service-to-a-member-account
+  historical_source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-organizations-prinvesc/README.md#organizationsregisterdelegatedadministrator--hand-a-services-org-wide-control-to-an-account-you-own
   technique: aws-organizations-registerdelegatedadministrator
   reason: RegisterDelegatedAdministrator alone grants only service-specific delegation to a separate controlled
     member-account identity. The catalog does not bind that identity, service-specific administrative actions, or

src/privilege-escalation-paths/aws/_excluded_scoped_role_overclaim_20261016.yaml

@@ -44,10 +44,12 @@
     bucket, prefix or object. The separate aws-s3-accessgrants-self-grant route models a verified new READ
     permission on that bounded scope without claiming the location role's other permissions.
 - source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-snowball-post-exploitation/README.md#snowballcreatejob--iampassrole--create-a-physical-s3-export-through-a-privileged-role
+  historical_source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-snowball-privesc/README.md#snowballcreatejob--iampassrole--create-a-physical-s3-export-through-a-privileged-role
   technique: aws-snowball-passrole-createjob
   reason: The passed role is used only for a physical S3 export job; the source receives data, not the role identity
     or IAM permissions.
 - source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-snowball-post-exploitation/README.md#snowballupdatejob--make-an-existing-snow-role-export-additional-s3-data-to-another-address
+  historical_source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-snowball-privesc/README.md#snowballupdatejob--make-an-existing-snow-role-export-additional-s3-data-to-another-address
   technique: aws-snowball-updatejob-existing-role
   reason: Retargeting a physical export job discloses selected S3 data but does not yield the stored role identity
     or IAM permissions.

src/privilege-escalation-paths/aws/_excluded_uncollected_host_join_strict_reaudit_20261016.yaml

@@ -77,6 +77,7 @@
     source operation reaches.
   prior_id: aws-gamelift-getcomputeaccess-fleet-instance-role
 - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mainframe-modernization-privesc/README.md#m2updateapplication---store-a-malicious-application-version-for-later-deployment
+  historical_source: src/pentesting-cloud/aws-security/aws-persistence/aws-mainframe-modernization-persistence/README.md#m2updateapplication---store-a-malicious-application-version-for-later-deployment
   source_revision: b587e6bd26
   technique: Deploy a modified M2 application version under its existing role
   reason: 'UpdateApplication creates a stored application version without changing its roleArn
@@ -89,12 +90,16 @@
     a reachable role.'
   prior_id: aws-m2-updateapplication-deploy-existing-role
 - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-bedrock-agentcore-privesc/README.md#aws---agentcore-harness-rce-via-indirect-prompt-injection
+  historical_source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-bedrock-post-exploitation/README.md#aws---agentcore-harness-rce-via-indirect-prompt-injection
   source_revision: b587e6bd26
   technique: Invoke an existing AgentCore harness with its shell tool to run commands as its execution
     role
-  reason: The bedrock-agentcore_harness resource-to-role attachment is not loaded by the AWS evaluator
-    (absent from HOST_KIND); service trust or a guessed resource cannot identify the exact role
-    that the source operation reaches.
+  reason: InvokeHarness may pass attacker-controlled content to a harness with shell available, but the
+    API does not dispatch a caller-supplied toolUse block. The model must choose the shell tool. A
+    principal edge needs the exact reachable harness, effective invocation permission, controlled
+    input actually consumed, shell allowed for that invocation, useful command execution under its
+    role, and a resulting role-authorized action or credential. Those runtime facts are not
+    collected.
   prior_id: aws-bedrock-agentcore-invokeharness-shell-existing
 - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc/README.md#lambdacreatemicrovmshellauthtoken--shell-into-an-existing-lambda-microvm
   source_revision: 171e422299