AWS - Step Functions Post Exploitation
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
For more information about this AWS service, check:
states:RevealSecretsThis permission allows to reveal secret data inside an execution. For it, it's needed to set Inspection level to TRACE and the revealSecrets parameter to true.
states:DeleteStateMachine, states:DeleteStateMachineVersion, states:DeleteStateMachineAliasAn attacker with these permissions would be able to permanently delete state machines, their versions, and aliases. This can disrupt critical workflows, result in data loss, and require significant time to recover and restore the affected state machines. In addition, it would allow an attacker to cover the tracks used, disrupt forensic investigations, and potentially cripple operations by removing essential automation processes and state configurations.
Deleting a state machine you also delete all its associated versions and aliases.
Deleting a state machine alias you do not delete the state machine versions referecing this alias.
It is not possible to delete a state machine version currently referenced by one o more aliases.
Potential Impact: Disruption of critical workflows, data loss, and operational downtime.
states:UpdateMapRunAn attacker with this permission would be able to manipulate the Map Run failure configuration and parallel setting, being able to increase or decrease the maximum number of child workflow executions allowed, affecting directly and performance of the service. In addition, an attacker could tamper with the tolerated failure percentage and count, being able to decrease this value to 0 so every time an item fails, the whole map run would fail, affecting directly to the state machine execution and potentially disrupting critical workflows.
Potential Impact: Performance degradation, and disruption of critical workflows.
states:StopExecutionAn attacker with this permission could be able to stop the execution of any state machine, disrupting ongoing workflows and processes. This could lead to incomplete transactions, halted business operations, and potential data corruption.
This action is not supported by express state machines.
Potential Impact: Disruption of ongoing workflows, operational downtime, and potential data corruption.
states:TagResource, states:UntagResourceAn attacker could add, modify, or remove tags from Step Functions resources, disrupting your organization's cost allocation, resource tracking, and access control policies based on tags.
Potential Impact: Disruption of cost allocation, resource tracking, and tag-based access control policies.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
