Skip to content

Commit 3f8aa12

Browse files
authored
Update README to specify Airflow DAG permissions
Clarified that all Airflow DAGs run with the execution role's permissions.
1 parent 8c472fb commit 3f8aa12

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

  • src/pentesting-cloud/aws-security/aws-post-exploitation/aws-mwaa-post-exploitation

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-mwaa-post-exploitation/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ Documentation Verifying Vuln and Acknowledging Vectorr: [AWS Documentation](http
2727

2828
## Exploitation
2929

30-
All DAGs run with the execution role's permissions. DAGs are Python scripts that can execute arbitrary code - they can use `yum` or `curl` to install tools, download malicious scripts, or import any Python library. DAGs are pulled from an assigned S3 folder and run on schedule automatically, all an attacker needs is ability to PUT to that bucket path.
30+
All Airflow DAGs run with the execution role's permissions. DAGs are Python scripts that can execute arbitrary code - they can use `yum` or `curl` to install tools, download malicious scripts, or import any Python library. DAGs are pulled from an assigned S3 folder and run on schedule automatically, all an attacker needs is ability to PUT to that bucket path.
3131

3232
Anyone who can write DAGs (typically most users in MWAA environments) can abuse this permission:
3333

0 commit comments

Comments
 (0)