When You Can’t Afford to Guess

Provide a detailed analysis.

This changeset was rejected with a verdict of UNSAFE due to

CRITICAL and HIGH security risks across all 152 simulations. The

proposed IAM policy would attach to

OrganizationAccountAccessRole

, creating a privilege escalation

path from a management account root user to unrestricted network-

level access across member accounts in the AWS organization.

Verdict Summary

Metric

Value

Total simulations

152

Unsafe verdicts

152 (100%)

Critical risk

2

High risk

150

Primary failure

mode

Security (100%)

Max blast radius

Cross-account / Organization-wide

network compromise

Risk Analysis

The change grants

ec2:ModifyNetworkInterfaceAttribute

on

*

resources to

OrganizationAccountAccessRole

. This action—

combined with the role's existing trust relationship allowing assumption

by the management account (284619037512) root user—creates a

deterministic attack chain with three stages of exploitation.

Stage 1: Privilege Escalation Through Cross-

Account Trust

The

OrganizationAccountAccessRole

in account 630457192846

authorizes sessions for the root user of account 284619037512. By

attaching this policy, any principal capable of assuming the role

(management account root, or users with sufficient IAM permissions

like

skelly

via the

Admins

group) gains the ability to modify any

network interface attribute in the target account.

Stage 2: Network Interface Manipulation Attack

Surface

The

ec2:ModifyNetworkInterfaceAttribute

permission enables:

•

Security group attachment changes — detaching restrictive

groups, attaching permissive ones

•

Source/destination check modification — disabling allows

instances to intercept traffic not addressed to them (promiscuous

mode)

•

ENI attachment manipulation — moving interfaces between

instances, redirecting traffic flows

•

IP address reassignment — modifying private or public IP

bindings

Stage 3: Blast Radius Across Infrastructure

Components

Simulations identified compromise paths to:

Component

Impact

Count

NAT gateways

Traffic interception,

outbound connectivity

disruption

Multiple

Private EC2 instances

Network isolation

bypass, lateral

movement

Multiple

VPC infrastructure

Network

segmentation

subversion

Multiple

Service-linked roles

(EFS, Glue, GuardDuty,

Cost Optimization)

Service disruption,

data access

4+

IAM users with API

credentials

Credential harvesting

via traffic interception

2+

Security groups

Policy bypass,

unauthorized access

Multiple

Critical Findings

Two simulations escalated to CRITICAL risk (Simulation 8 and one

other), indicating organization-wide impact potential. Simulation 8

specifically traced a path where the management account root user—

through

OrganizationAccountAccessRole

assumption—could

manipulate network interfaces across account 284619037512,

effectively granting network-level control equivalent to full account

compromise.

The depth distribution shows attack chains reaching 4–9 steps, with 66

simulations at depth 4 and substantial representation at depths 5–9,

indicating complex but traversable privilege escalation paths through

the AWS resource graph.

Specific Compromise Scenarios

NAT Gateway Compromise Multiple simulations (2, 3, 15, 18, 20, 31)

identified

nat-083b754eeecf21d9c

in ca-central-1 as directly

exposed. An attacker with this role could modify the NAT gateway's ENI

to:

•

Redirect outbound traffic through attacker-controlled infrastructure

•

Disrupt connectivity for entire VPCs dependent on the gateway

•

Intercept traffic for credential harvesting or data exfiltration

Private Instance Exposure Simulations 4, 25, and 27 traced paths to

private EC2 instances (

i-094b33cfcfafc328e

,

i-

093ddb616ecb97edc

). The

ModifyNetworkInterfaceAttribute

permission allows bypassing security group protections that isolate

these instances from public networks, effectively exposing internal

workloads.

Service Role Cascade Service-linked roles for EFS, Glue, GuardDuty

Malware Protection, and Cost Optimization Hub were identified as

secondary targets. Network interface manipulation could disrupt these

services or expose their data processing capabilities to unauthorized

access.

Assumptions and Constraints

The simulations operate under these documented assumptions:

•

No Service Control Policies (SCPs) or permission boundaries restrict

OrganizationAccountAccessRole

•

No external ID or MFA requirements exist for role assumption

•

The wildcard resource (

*

) in the IAM policy applies to all ENIs

without resource-level conditions

•

Target accounts contain production workloads with network

interfaces providing security boundaries

If any of these assumptions do not hold in the actual environment, the

effective risk may differ—but the policy as written provides no such

guardrails.

Recommended Evaluation

Before any remediation, verify:

1.

Whether

OrganizationAccountAccessRole

truly requires ENI

modification permissions — this is an administrative cross-

account role typically used for account provisioning and governance,

not network-level operations

2.

Whether resource-level conditions or specific ENI ARNs can

replace the

*

resource scope

3.

Whether the trust relationship with account 284619037512 is

still required, or can be narrowed to specific delegated administrative

roles

4.

Whether existing VPC endpoint policies or SCPs already

mitigate this risk in the target environments

The unsafe paths identified in the simulations are available in the UI for

visual inspection of the complete attack chains through the

infrastructure graph.*