Skip to content

Commit 3f8aa12

Browse files
authored
Update README to specify Airflow DAG permissions
Clarified that all Airflow DAGs run with the execution role's permissions.
1 parent 8c472fb commit 3f8aa12

File tree

1 file changed

+1
-1
lines changed
  • src/pentesting-cloud/aws-security/aws-post-exploitation/aws-mwaa-post-exploitation

1 file changed

+1
-1
lines changed

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-mwaa-post-exploitation/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ Documentation Verifying Vuln and Acknowledging Vectorr: [AWS Documentation](http
2727

2828
## Exploitation
2929

30-
All DAGs run with the execution role's permissions. DAGs are Python scripts that can execute arbitrary code - they can use `yum` or `curl` to install tools, download malicious scripts, or import any Python library. DAGs are pulled from an assigned S3 folder and run on schedule automatically, all an attacker needs is ability to PUT to that bucket path.
30+
All Airflow DAGs run with the execution role's permissions. DAGs are Python scripts that can execute arbitrary code - they can use `yum` or `curl` to install tools, download malicious scripts, or import any Python library. DAGs are pulled from an assigned S3 folder and run on schedule automatically, all an attacker needs is ability to PUT to that bucket path.
3131

3232
Anyone who can write DAGs (typically most users in MWAA environments) can abuse this permission:
3333

0 commit comments

Comments
 (0)