Complete AWS exclusion historical source bindings

src/privilege-escalation-paths/aws/_excluded_artifact_join_strict_reaudit_20261016.yaml

@@ -74,6 +74,7 @@
     artifact alone cannot establish a principal-to-principal path.'
   prior_id: aws-elasticbeanstalk-rebuildenvironment-s3-code
 - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codeartifact-privesc/README.md#publish-a-newer-compatible-package-version
+  historical_source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codeartifact-post-exploitation/README.md#publish-a-newer-compatible-package-version
   source_revision: b587e6bd26
   technique: Publish a newer compatible version of a trusted CodeArtifact package consumed by
     a privileged workload

src/privilege-escalation-paths/aws/_excluded_consumer_input_join_strict_reaudit_20261016.yaml

@@ -126,6 +126,7 @@
     gain.'
   prior_id: aws-codecommit-gitpush-pipeline-source-cloudformation-role
 - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codecommit-pipeline-source-privesc/README.md#push-a-codecommit-source-revision-executed-by-a-codebuild-project
+  historical_source: src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-codebuild-unauthenticated-access/README.md#buildspecyml
   source_revision: b587e6bd26
   technique: Push a CodeCommit source revision executed by a CodeBuild project
   reason: 'The codecommit:GitPush source operation is not joined to an exact consumed input and

src/privilege-escalation-paths/aws/_excluded_secondary_bounded_role_overclaim_20261016.yaml

@@ -1,5 +1,6 @@
 # Additional role targets whose service execution is bounded by a fixed configuration or file/SQL session.
 - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-appsync-privesc/README.md#hijack-resolver-function-or-data-source-behavior
+  historical_source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-appsync-post-exploitation/README.md#hijack-resolver-function-or-data-source-behavior
   technique: aws-appsync-updateresolver-existing-datasource-role
   reason: Only HTTP data sources with IAM authorization can sign arbitrary AWS API calls. This entry targets every
     existing AppSync data-source role, including DynamoDB/OpenSearch/RDS/EventBridge backends whose role use is

src/privilege-escalation-paths/aws/_excluded_uncollected_service_join_final_reaudit_20261016.yaml

@@ -41,6 +41,7 @@
     conditional route is excluded from the automatic principal graph.
   prior_id: aws-ecs-capacity-provider-hijack
 - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mwaa-privesc/README.md#classic-mwaa-airflowcreateweblogintoken--airflowcreateclitoken--code-execution-as-the-environment-execution-role
+  historical_source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-mwaa-post-exploitation/README.md#classic-mwaa-airflowcreateweblogintoken--airflowcreateclitoken--code-execution-as-the-environment-execution-role
   source_revision: b587e6bd26
   technique: Mint an Airflow CLI token for an MWAA environment and run code as its execution role
   reason: CreateCliToken grants a CLI session for one MWAA environment, but that session does not
@@ -49,6 +50,7 @@
     code or code-bearing input the source controls. Those Airflow and DAG facts are not collected.
   prior_id: aws-mwaa-createclitoken-execution-role
 - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mwaa-privesc/README.md#classic-mwaa-airflowcreateweblogintoken--airflowcreateclitoken--code-execution-as-the-environment-execution-role
+  historical_source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-mwaa-post-exploitation/README.md#classic-mwaa-airflowcreateweblogintoken--airflowcreateclitoken--code-execution-as-the-environment-execution-role
   source_revision: b587e6bd26
   technique: Mint an Airflow web-login token for an MWAA environment and run code as its execution
     role

src/privilege-escalation-paths/aws/_excluded_unjoined_subject_strict_reaudit_20261016.yaml

@@ -50,13 +50,15 @@
     credential or exact permission-set assignment scope.
   prior_id: aws-identitystore-createuser-createaccountassignment
 - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-pca-connector-ad-privesc/README.md#pca-connector-adcreatetemplate--change-ad-certificate-enrollment-rules
+  historical_source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-pca-connector-ad-privesc/README.md#pca-connector-adcreatetemplate--publish-a-malicious-certificate-template-esc1--esc9
   source_revision: 171e422299
   technique: Publish a malicious certificate template through PCA Connector for AD and enroll
     as a domain admin
   reason: Template creation does not prove the source controls an enrollable AD identity or that
     certificate mapping authenticates as the exact directory admin.
   prior_id: aws-pca-connector-ad-createtemplate-esc1
 - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-pca-connector-ad-privesc/README.md#pca-connector-adupdatetemplate--change-an-existing-certificate-template
+  historical_source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-pca-connector-ad-privesc/README.md#pca-connector-adupdatetemplate--weaken-an-existing-legitimate-template-in-place
   source_revision: 171e422299
   technique: Weaken an existing PCA Connector for AD certificate template in place
   reason: Template update does not prove the source controls an enrollable AD identity or that