Skip to content

Commit

Permalink
fix(aws-glue-privesc.md): add condition on glue pass-role attack
Browse files Browse the repository at this point in the history
  • Loading branch information
ThomasLachaux authored Apr 19, 2024
1 parent 51132cc commit 43b52d6
Showing 1 changed file with 1 addition and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ Other ways to support HackTricks:

### `iam:PassRole`, `glue:CreateDevEndpoint`, (`glue:GetDevEndpoint` | `glue:GetDevEndpoints`)

Users with these permissions can **set up a new AWS Glue development endpoin**t, **assigning an existing service role** with specific permissions to this endpoint.
Users with these permissions can **set up a new AWS Glue development endpoint**, **assigning an existing service role assumable by Glue** with specific permissions to this endpoint.

After the setup, the **attacker can SSH into the endpoint's instance**, and steal the IAM credentials of the assigned role:

Expand Down

0 comments on commit 43b52d6

Please sign in to comment.