Document live-validated AWS data-access techniques

src/SUMMARY.md

@@ -295,7 +295,9 @@
     - [AWS - EFS Post Exploitation](pentesting-cloud/aws-security/aws-post-exploitation/aws-efs-post-exploitation/README.md)
     - [AWS - EKS Post Exploitation](pentesting-cloud/aws-security/aws-post-exploitation/aws-eks-post-exploitation/README.md)
     - [AWS - Elastic Beanstalk Post Exploitation](pentesting-cloud/aws-security/aws-post-exploitation/aws-elastic-beanstalk-post-exploitation/README.md)
+    - [AWS - Glue Post Exploitation](pentesting-cloud/aws-security/aws-post-exploitation/aws-glue-post-exploitation/README.md)
     - [AWS - IAM Post Exploitation](pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation/README.md)
+      - [AWS resource-policy principal validation](pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation/aws-resource-policy-principal-validation.md)
     - [AWS - KMS Post Exploitation](pentesting-cloud/aws-security/aws-post-exploitation/aws-kms-post-exploitation/README.md)
     - [AWS - Lambda Post Exploitation](pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/README.md)
       - [AWS - Lambda EFS Mount Injection](pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-efs-mount-injection.md)
@@ -394,23 +396,33 @@
       - [AWS - Trusted Advisor Enum](pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-trusted-advisor-enum.md)
       - [AWS - WAF Enum](pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-waf-enum.md)
     - [AWS - Account Management Enum](pentesting-cloud/aws-security/aws-services/aws-account-management-enum.md)
+    - [AWS - Amazon Connect Enum](pentesting-cloud/aws-security/aws-services/aws-connect-enum.md)
+    - [AWS - Amazon Connect Customer Profiles Enum](pentesting-cloud/aws-security/aws-services/aws-connect-customer-profiles-enum.md)
+    - [AWS - Amazon Q in Connect Enum](pentesting-cloud/aws-security/aws-services/aws-q-in-connect-enum.md)
     - [AWS - API Gateway Enum](pentesting-cloud/aws-security/aws-services/aws-api-gateway-enum.md)
+    - [AWS - AppConfig Enum](pentesting-cloud/aws-security/aws-services/aws-appconfig-enum.md)
+    - [AWS - AppSync Enum](pentesting-cloud/aws-security/aws-services/aws-appsync-enum.md)
+    - [AWS - Aurora DSQL Enum](pentesting-cloud/aws-security/aws-services/aws-aurora-dsql-enum.md)
+    - [AWS - Batch Enum](pentesting-cloud/aws-security/aws-services/aws-batch-enum.md)
     - [AWS - Bedrock Enum](pentesting-cloud/aws-security/aws-services/aws-bedrock-enum.md)
     - [AWS - Certificate Manager (ACM) & Private Certificate Authority (PCA)](pentesting-cloud/aws-security/aws-services/aws-certificate-manager-acm-and-private-certificate-authority-pca.md)
     - [AWS - CloudFormation & Codestar Enum](pentesting-cloud/aws-security/aws-services/aws-cloudformation-and-codestar-enum.md)
     - [AWS - CloudHSM Enum](pentesting-cloud/aws-security/aws-services/aws-cloudhsm-enum.md)
     - [AWS - CloudFront Enum](pentesting-cloud/aws-security/aws-services/aws-cloudfront-enum.md)
     - [AWS - Codebuild Enum](pentesting-cloud/aws-security/aws-services/aws-codebuild-enum.md)
+    - [AWS - CodeArtifact Enum](pentesting-cloud/aws-security/aws-services/aws-codeartifact-enum.md)
     - [AWS - Cognito Enum](pentesting-cloud/aws-security/aws-services/aws-cognito-enum/README.md)
       - [Cognito Identity Pools](pentesting-cloud/aws-security/aws-services/aws-cognito-enum/cognito-identity-pools.md)
       - [Cognito User Pools](pentesting-cloud/aws-security/aws-services/aws-cognito-enum/cognito-user-pools.md)
     - [AWS - DataPipeline, CodePipeline & CodeCommit Enum](pentesting-cloud/aws-security/aws-services/aws-datapipeline-codepipeline-codebuild-and-codecommit.md)
+    - [AWS - Deadline Cloud Enum](pentesting-cloud/aws-security/aws-services/aws-deadline-cloud-enum.md)
     - [AWS - Directory Services / WorkDocs Enum](pentesting-cloud/aws-security/aws-services/aws-directory-services-workdocs-enum.md)
     - [AWS - DocumentDB Enum](pentesting-cloud/aws-security/aws-services/aws-documentdb-enum/README.md)
     - [AWS - DynamoDB Enum](pentesting-cloud/aws-security/aws-services/aws-dynamodb-enum.md)
     - [AWS - EC2, EBS, ELB, SSM, VPC & VPN Enum](pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/README.md)
       - [AWS - Nitro Enum](pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/aws-nitro-enum.md)
       - [AWS - VPC & Networking Basic Information](pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/aws-vpc-and-networking-basic-information.md)
+    - [AWS - EC2 Image Builder Enum](pentesting-cloud/aws-security/aws-services/aws-ec2-image-builder-enum.md)
     - [AWS - ECR Enum](pentesting-cloud/aws-security/aws-services/aws-ecr-enum.md)
     - [AWS - ECS Enum](pentesting-cloud/aws-security/aws-services/aws-ecs-enum.md)
     - [AWS - EKS Enum](pentesting-cloud/aws-security/aws-services/aws-eks-enum.md)
@@ -420,12 +432,20 @@
     - [AWS - EFS Enum](pentesting-cloud/aws-security/aws-services/aws-efs-enum.md)
     - [AWS - EventBridge Scheduler Enum](pentesting-cloud/aws-security/aws-services/eventbridgescheduler-enum.md)
     - [AWS - Kinesis Data Firehose Enum](pentesting-cloud/aws-security/aws-services/aws-kinesis-data-firehose-enum.md)
+    - [AWS - Kinesis Data Streams Enum](pentesting-cloud/aws-security/aws-services/aws-kinesis-data-streams-enum.md)
+    - [AWS - Managed Service for Apache Flink Enum](pentesting-cloud/aws-security/aws-services/aws-managed-flink-enum.md)
+    - [AWS - Managed Service for Prometheus Enum](pentesting-cloud/aws-security/aws-services/aws-managed-prometheus-enum.md)
     - [AWS - IAM, Identity Center & SSO Enum](pentesting-cloud/aws-security/aws-services/aws-iam-enum.md)
     - [AWS - Invoicing Enum](pentesting-cloud/aws-security/aws-services/aws-invoicing-enum.md)
+    - [AWS - IoT Core Enum](pentesting-cloud/aws-security/aws-services/aws-iot-core-enum.md)
+    - [AWS - IoT Wireless Enum](pentesting-cloud/aws-security/aws-services/aws-iot-wireless-enum.md)
+    - [AWS - IoT Greengrass Enum](pentesting-cloud/aws-security/aws-services/aws-greengrass-enum.md)
     - [AWS - KMS Enum](pentesting-cloud/aws-security/aws-services/aws-kms-enum.md)
     - [AWS - Lambda Enum](pentesting-cloud/aws-security/aws-services/aws-lambda-enum.md)
+    - [AWS - Lex V2 Enum](pentesting-cloud/aws-security/aws-services/aws-lex-v2-enum.md)
     - [AWS - Lightsail Enum](pentesting-cloud/aws-security/aws-services/aws-lightsail-enum.md)
     - [AWS - Macie Enum](pentesting-cloud/aws-security/aws-services/aws-macie-enum.md)
+    - [AWS - MediaPackage v2 Enum](pentesting-cloud/aws-security/aws-services/aws-mediapackage-v2-enum.md)
     - [AWS - MQ Enum](pentesting-cloud/aws-security/aws-services/aws-mq-enum.md)
     - [AWS - MSK Enum](pentesting-cloud/aws-security/aws-services/aws-msk-enum.md)
     - [AWS - Organizations Enum](pentesting-cloud/aws-security/aws-services/aws-organizations-enum.md)
@@ -438,9 +458,12 @@
     - [AWS - SNS Enum](pentesting-cloud/aws-security/aws-services/aws-sns-enum.md)
     - [AWS - SQS Enum](pentesting-cloud/aws-security/aws-services/aws-sqs-and-sns-enum.md)
     - [AWS - S3, Athena & Glacier Enum](pentesting-cloud/aws-security/aws-services/aws-s3-athena-and-glacier-enum.md)
+    - [AWS - S3 Tables and S3 Vectors Enum](pentesting-cloud/aws-security/aws-services/aws-s3-tables-and-vectors-enum.md)
     - [AWS - Step Functions Enum](pentesting-cloud/aws-security/aws-services/aws-stepfunctions-enum.md)
     - [AWS - STS Enum](pentesting-cloud/aws-security/aws-services/aws-sts-enum.md)
     - [AWS - Tax Settings Enum](pentesting-cloud/aws-security/aws-services/aws-tax-settings-enum.md)
+    - [AWS - Transcribe Enum](pentesting-cloud/aws-security/aws-services/aws-transcribe-enum.md)
+    - [AWS - VPC Lattice Enum](pentesting-cloud/aws-security/aws-services/aws-vpc-lattice-enum.md)
     - [AWS - WorkMail Enum](pentesting-cloud/aws-security/aws-services/aws-workmail-enum.md)
     - [AWS - WorkSpaces Enum](pentesting-cloud/aws-security/aws-services/aws-workspaces-enum.md)
     - [AWS - Other Services Enum](pentesting-cloud/aws-security/aws-services/aws-other-services-enum.md)

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-glue-post-exploitation/README.md

@@ -0,0 +1,86 @@
+# AWS - Glue Post Exploitation
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+AWS Glue stores job definitions, connection profiles, crawlers, workflows, and Data Catalog metadata in its control plane. Some read APIs return operator-supplied values verbatim, so read-only Glue access can disclose credentials before any job is executed.
+
+## glue:GetConnection — tested plaintext connection credentials
+
+A Glue connection can hold JDBC URLs, usernames, passwords, tokens, and service-specific properties in ConnectionProperties. GetConnection accepts a caller-controlled HidePassword flag; request false when testing whether the password is recoverable.<sup>[[1]](#references)[[2]](#references)</sup>
+
+~~~bash
+aws glue get-connection \
+  --name <known-connection-name> \
+  --no-hide-password \
+  --region <region> \
+  --query 'Connection.{Name:Name,Type:ConnectionType,Properties:ConnectionProperties}'
+~~~
+
+{% hint style="danger" %}
+This was validated with an STS session policy containing only **glue:GetConnection**. A disposable JDBC connection held a unique random value in its PASSWORD property; the response returned that value exactly. No network connection or Glue job was run. The connection and test role were then deleted. Treat the action as **high** because it can directly return reusable data-store credentials.
+{% endhint %}
+
+The result depends on how the connection was configured. Secrets referenced indirectly through Secrets Manager are identifiers rather than secret values and require separate Secrets Manager access. When Glue Data Catalog encryption uses a customer KMS key, effective access can also depend on the key policy and **kms:Decrypt**; do not assume every connection password is decryptable merely because GetConnection is allowed.<sup>[[2]](#references)[[3]](#references)</sup>
+
+## glue:GetJob — tested job-argument and environment disclosure
+
+GetJob returns the job definition, including its execution role, command and script location, Glue connections, default arguments, non-overridable arguments, worker configuration, security configuration, and execution-class settings.<sup>[[4]](#references)</sup> Developers sometimes put database passwords, API tokens, internal URLs, or feature credentials directly in argument maps.
+
+~~~bash
+aws glue get-job --job-name <known-job-name> --region <region> \
+  --query 'Job.{Role:Role,Command:Command,Connections:Connections,DefaultArguments:DefaultArguments,NonOverridableArguments:NonOverridableArguments,SecurityConfiguration:SecurityConfiguration}'
+~~~
+
+{% hint style="danger" %}
+This was validated independently with an STS session policy containing only **glue:GetJob**. A disposable, never-executed ETL job stored a random sentinel in DefaultArguments; GetJob returned the exact plaintext value. The job, its unused service role, and the reader role were deleted. Treat the action as **high** for secret discovery, but not as privilege escalation by itself.
+{% endhint %}
+
+Reading a role ARN or script location does not grant that role or S3 object. Actual code access needs the relevant S3 permission, and executing or changing the job needs the separate Glue write/run and iam:PassRole paths described in the Glue privilege-escalation page.
+
+## glue:GetWorkflowRunProperties — tested run-property disclosure
+
+Glue workflow run properties are a string-to-string map used to pass shared state between jobs, crawlers, and triggers in one workflow run. Properties can hold dataset locations, database connection information, tokens, or other operator-supplied values. `GetWorkflowRunProperties` returns the complete map for a known workflow name and run ID.<sup>[[5]](#references)[[6]](#references)</sup>
+
+~~~bash
+# The workflow name and run ID can be supplied directly.
+aws glue get-workflow-run-properties \
+  --name <known-workflow-name> \
+  --run-id <known-run-id> \
+  --query RunProperties
+~~~
+
+{% hint style="danger" %}
+This was validated with an STS session restricted to `glue:GetWorkflowRunProperties`. A disposable workflow run stored a unique random sentinel through `PutWorkflowRunProperties`; the exact read returned it. The run was stopped immediately, and its trigger, tiny Python-shell job, workflow, script bucket, service role, and reader role were deleted. Treat the read as **high** for literal shared run state. It does not allow modification, job execution, or access to an S3/Secrets Manager value that is only referenced.
+{% endhint %}
+
+If Glue list/read APIs are unavailable, workflow names and run IDs may still appear in CloudFormation/Terraform, CloudTrail, Step Functions or EventBridge configuration, CI/CD logs, Glue job arguments, CloudWatch logs, console URLs, source code, or local shell history. Run properties are per-run, so enumerate only run IDs learned through an authorized source and do not assume the newest run contains the same values as older runs.
+
+{{#ref}}
+../../aws-privilege-escalation/aws-glue-privesc/README.md
+{{#endref}}
+
+## Discovery without Glue list permissions
+
+GetConnection, GetJob, and GetWorkflowRunProperties accept specific identifiers, so Glue list permissions are not required when they are already known. Search these permissionless or independently authorized sources:
+
+* application source, IaC, deployment manifests, CI/CD output, shell history, tickets, and notebooks;
+* CloudTrail events such as CreateJob, UpdateJob, StartJobRun, CreateConnection, and UpdateConnection;
+* Step Functions definitions, EventBridge targets, Lambda environment variables, and Glue workflow/crawler references; and
+* predictable environment prefixes such as dev-, staging-, and prod-.
+
+If both Glue reads are denied, independently readable job scripts, CloudWatch logs, Secrets Manager entries, SSM parameters, and target data stores remain separate fallbacks. Each requires its own authorization; their mere names are not proof of data access.
+
+## Tested cleanup
+
+The connection/job-definition validation created no compute and started no job. The workflow-property validation briefly started a disposable workflow and immediately stopped its minimum-capacity Python-shell job. DeleteConnection, DeleteJob, DeleteTrigger, DeleteWorkflow, S3 bucket deletion, and IAM role deletion completed; follow-up Glue, S3, IAM, log-stream, tag, and service-specific lists found no live lab resources.
+
+## References
+
+- [1] [GetConnection API](https://docs.aws.amazon.com/glue/latest/webapi/API_GetConnection.html)
+- [2] [Connection structure and properties](https://docs.aws.amazon.com/glue/latest/webapi/API_Connection.html)
+- [3] [Encrypting the Data Catalog](https://docs.aws.amazon.com/glue/latest/dg/encrypt-glue-data-catalog.html)
+- [4] [GetJob API](https://docs.aws.amazon.com/glue/latest/webapi/API_GetJob.html)
+- [5] [Sharing properties between jobs in an AWS Glue workflow](https://docs.aws.amazon.com/glue/latest/dg/workflow-run-properties-code.html)
+- [6] [GetWorkflowRunProperties API](https://docs.aws.amazon.com/glue/latest/webapi/API_GetWorkflowRunProperties.html)
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation/README.md

@@ -10,6 +10,14 @@ For more information about IAM access:
 ../../aws-services/aws-iam-enum.md
 {{#endref}}
 
+### Resource-policy principal validation
+
+When a compromised principal can update resource-based policies, several AWS services can validate candidate external account IDs or IAM principal names. This is an expected post-exploitation reconnaissance technique—not cross-account access or a vulnerability—and every tested operation changes policy state.
+
+{{#ref}}
+aws-resource-policy-principal-validation.md
+{{#endref}}
+
 ## Confused Deputy Problem
 
 If you **allow an external account (A)** to access a **role** in your account, you will probably have **0 visibility** on **who can exactly access that external account**. This is a problem, because if another external account (B) can access the external account (A) it's possible that **B will also be able to access your account**.<sup>[[1]](#references)</sup>