AWS SageMaker Execution Role Passed by Unusual Principal

  1[metadata]
  2creation_date = "2026/07/13"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/07/13"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the first time an IAM principal passes a given execution role (`roleArn`) to an Amazon SageMaker resource,
 11via `CreateNotebookInstance`, `CreateTrainingJob`, `CreateProcessingJob`, `CreateAutoMLJob`, or `CreatePipeline`. These
 12actions require `iam:PassRole` and attach an IAM role that the created resource then runs as. An adversary holding both
 13SageMaker create permissions and a broad `iam:PassRole` grant can pass a more privileged role to a resource they control
 14and execute code as that role, escalating privileges. The rule keys on the combination of the calling principal and the
 15passed `roleArn`, so it surfaces a principal using an execution role it has not used before in the last 7 days; a role
 16whose account differs from the caller's, or that is more privileged than the caller, is especially suspicious.
 17"""
 18false_positives = [
 19    """
 20    MLOps pipelines and data science teams routinely create SageMaker resources with execution roles, and new pipelines
 21    or team members appear as new principals on first use. Verify the principal in `aws.cloudtrail.user_identity.arn`,
 22    the passed roleArn in `aws.cloudtrail.request_parameters`, and whether the role's privileges and the activity are
 23    approved. Known automation roles can be excluded after validation.
 24    """,
 25]
 26from = "now-7d"
 27interval = "10m"
 28language = "esql"
 29license = "Elastic License v2"
 30name = "AWS SageMaker Execution Role Passed by Unusual Principal"
 31note = """## Triage and analysis
 32
 33### Investigating AWS SageMaker Execution Role Passed by Unusual Principal
 34
 35SageMaker resource-creation actions accept a `roleArn` execution role and require the caller to hold `iam:PassRole`
 36for it. The created resource (notebook, training job, processing job, AutoML job, or pipeline) then runs as that
 37role. This is a known cloud privilege-escalation path: a principal with SageMaker create rights and a broad
 38`PassRole` permission can attach a more privileged role to a resource it controls and run code as that role. This
 39rule keys on the principal and the passed `roleArn` together, so it flags the first time a principal uses a given
 40execution role within the last 7 days, which should then be reviewed for over-privilege or a cross-account owner.
 41
 42#### Possible investigation steps
 43
 44- Identify the actor in `aws.cloudtrail.user_identity.arn`, and review `Esql.source_ip_values` and
 45  `Esql.user_agent_original_values` for an unexpected origin.
 46- Inspect `Esql.aws_cloudtrail_request_parameters_role_arn` and review that role's policies; determine whether it is
 47  more privileged than the caller.
 48- Determine whether the principal normally creates SageMaker resources and whether this aligns with an approved
 49  pipeline or project.
 50- Correlate with follow-on activity by the passed role, such as actions outside SageMaker, presigned URL generation,
 51  or lifecycle configuration changes that would provide interactive execution as the role.
 52
 53### False positive analysis
 54
 55- Legitimate MLOps creates SageMaker resources with execution roles; new pipelines and users appear as new
 56  principals on first use. Confirm the role and activity are approved and exclude known automation roles on
 57  `aws.cloudtrail.user_identity.arn` after validation.
 58
 59### Response and remediation
 60
 61- If unauthorized, stop and delete the created resource, and review any actions taken by the passed role.
 62- Rotate or restrict credentials for the principal if compromise is suspected, and constrain `iam:PassRole` and
 63  SageMaker create permissions so principals can only pass narrowly scoped, approved execution roles.
 64
 65"""
 66references = [
 67    "https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-roles.html",
 68    "https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateNotebookInstance.html",
 69    "https://stratus-red-team.cloud/attack-techniques/AWS/aws.execution.sagemaker-update-lifecycle-config/",
 70]
 71risk_score = 73
 72rule_id = "ca8c2751-5507-44f2-b58d-08958200cde9"
 73severity = "high"
 74tags = [
 75    "Domain: Cloud",
 76    "Data Source: AWS",
 77    "Data Source: Amazon Web Services",
 78    "Data Source: AWS SageMaker",
 79    "Use Case: Threat Detection",
 80    "Tactic: Privilege Escalation",
 81    "Resources: Investigation Guide",
 82]
 83timestamp_override = "event.ingested"
 84type = "esql"
 85
 86query = '''
 87FROM logs-aws.cloudtrail-*
 88| WHERE data_stream.dataset == "aws.cloudtrail"
 89    AND event.provider == "sagemaker.amazonaws.com"
 90    AND event.action IN (
 91      "CreateNotebookInstance",
 92      "CreateTrainingJob",
 93      "CreateProcessingJob",
 94      "CreateAutoMLJob",
 95      "CreatePipeline"
 96    )
 97    AND event.outcome == "success"
 98    AND aws.cloudtrail.user_identity.type != "AWSService"
 99| GROK aws.cloudtrail.request_parameters """.*roleArn=(?<Esql.aws_cloudtrail_request_parameters_role_arn>arn:aws[a-z-]*:iam::[0-9]{12}:role/[^,}]+).*"""
100| WHERE Esql.aws_cloudtrail_request_parameters_role_arn IS NOT NULL
101| EVAL Esql.principal_arn = COALESCE(
102    aws.cloudtrail.user_identity.session_context.session_issuer.arn,
103    aws.cloudtrail.user_identity.arn
104  )
105| STATS
106    Esql.timestamp_min = MIN(@timestamp),
107    Esql.timestamp_max = MAX(@timestamp),
108    Esql.ingested_min = MIN(COALESCE(event.ingested, @timestamp)),
109    Esql.event_count = COUNT(*),
110    Esql.event_action_values = VALUES(event.action),
111    Esql.source_ip_values = VALUES(source.ip),
112    Esql.user_agent_original_values = VALUES(user_agent.original),
113    Esql.user_identity_arn_values = VALUES(aws.cloudtrail.user_identity.arn),
114    Esql.cloud_account_id_values = VALUES(cloud.account.id),
115    Esql.cloud_region_values = VALUES(cloud.region)
116  BY Esql.principal_arn,
117     Esql.aws_cloudtrail_request_parameters_role_arn
118| WHERE Esql.ingested_min >= NOW() - 10 minutes
119| KEEP Esql.*
120'''
121
122[[rule.threat]]
123framework = "MITRE ATT&CK"
124
125[[rule.threat.technique]]
126id = "T1078"
127name = "Valid Accounts"
128reference = "https://attack.mitre.org/techniques/T1078/"
129
130[[rule.threat.technique.subtechnique]]
131id = "T1078.004"
132name = "Cloud Accounts"
133reference = "https://attack.mitre.org/techniques/T1078/004/"
134
135[rule.threat.tactic]
136id = "TA0004"
137name = "Privilege Escalation"
138reference = "https://attack.mitre.org/tactics/TA0004/"
139
140[rule.investigation_fields]
141field_names = [
142    "Esql.principal_arn",
143    "Esql.aws_cloudtrail_request_parameters_role_arn",
144    "Esql.user_identity_arn_values",
145    "Esql.timestamp_min",
146    "Esql.timestamp_max",
147    "Esql.event_count",
148    "Esql.event_action_values",
149    "Esql.source_ip_values",
150    "Esql.user_agent_original_values",
151    "Esql.cloud_account_id_values",
152    "Esql.cloud_region_values",
153]