Integrate verified privesc v4 catalog fragments (AWS/GCP/Azure/K8s)

src/privilege-escalation-paths/aws/_excluded_171e_g1.yaml

@@ -1,27 +1,34 @@
 # AWS G1 review at 171e422299 (identity/org/billing pages): headings intentionally NOT modelled as privesc edges.
 # Each item: {source, technique, reason, source_revision}.
 
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-invoicing-and-billing-privesc/README.md#no-direct-iam-role-escalation-primitive
+- source:
+    src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-invoicing-and-billing-privesc/README.md#no-direct-iam-role-escalation-primitive
   technique: "Invoicing and Billing has no role-escalation primitive"
-  reason: "Not a privesc: the page states the Invoicing and Billing APIs take no execution role, need no iam:PassRole and return no AWS credentials; their effects are financial-data disclosure and billing changes."
+  reason: "Not a privesc: the page states the Invoicing and Billing APIs take no execution role, need no iam:PassRole and
+    return no AWS credentials; their effects are financial-data disclosure and billing changes."
   source_revision: 171e422299
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-invoicing-and-billing-privesc/README.md#turn-cost-view-administration-into-cross-account-disclosure
+- source:
+    src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-invoicing-and-billing-privesc/README.md#turn-cost-view-administration-into-cross-account-disclosure
   technique: "Share a custom Billing view through AWS RAM"
-  reason: "Not a privesc: cross-account disclosure of cost-and-usage data; the recipient gains no role or IAM authority and must accept a RAM invitation."
+  reason: "Not a privesc: cross-account disclosure of cost-and-usage data; the recipient gains no role or IAM authority and
+    must accept a RAM invitation."
   source_revision: 171e422299
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-invoicing-and-billing-privesc/README.md#enable-previously-granted-legacy-billing-permissions
-  technique: "billing:UpdateIAMAccessPreference"
-  reason: "Not a privesc: activates Billing permissions that identities already hold in IAM (invoice, credit, payment and preference access); it grants no new policy and no IAM or role authority."
-  source_revision: 171e422299
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-invoicing-and-billing-privesc/README.md#abuse-invoice-receiver-delegation
+- source:
+    src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-invoicing-and-billing-privesc/README.md#abuse-invoice-receiver-delegation
   technique: "invoicing:CreateInvoiceUnit receiver delegation"
-  reason: "Not a privesc: lets an eligible member account download the unit's invoice documents; it grants no access to other AWS APIs or payer-account resources."
+  reason: "Not a privesc: lets an eligible member account download the unit's invoice documents; it grants no access to other
+    AWS APIs or payer-account resources."
   source_revision: 171e422299
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-invoicing-and-billing-privesc/README.md#the-billing-service-linked-role-is-not-a-general-escalation-target
+- source:
+    src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-invoicing-and-billing-privesc/README.md#the-billing-service-linked-role-is-not-a-general-escalation-target
   technique: "AWSServiceRoleForBilling"
-  reason: "Not a privesc: the service-linked role only allows billing:GetBillingViewData, is trusted only by billing.amazonaws.com and cannot be edited or attached to other identities."
+  reason: "Not a privesc: the service-linked role only allows billing:GetBillingViewData, is trusted only by billing.amazonaws.com
+    and cannot be edited or attached to other identities."
   source_revision: 171e422299
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-invoicing-and-billing-privesc/README.md#related-actions-that-amplify-business-impact-not-iam-authority
-  technique: "billing:PutResourcePolicy, billing:UseSourceView, invoicing:GetInvoicePDF, invoicing:GetProcurementPortalPreference, billing:UpdateBillingPreferences"
-  reason: "Not a privesc: the page lists these as financial or governance impact (billing-view sharing, invoice URLs, a procurement-integration secret, credit allocation), not IAM authority."
+- source:
+    src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-invoicing-and-billing-privesc/README.md#related-actions-that-amplify-business-impact-not-iam-authority
+  technique: "billing:PutResourcePolicy, billing:UseSourceView, invoicing:GetInvoicePDF, invoicing:GetProcurementPortalPreference,
+    billing:UpdateBillingPreferences"
+  reason: "Not a privesc: the page lists these as financial or governance impact (billing-view sharing, invoice URLs, a procurement-integration
+    secret, credit allocation), not IAM authority."
   source_revision: 171e422299

src/privilege-escalation-paths/aws/_excluded_171e_g7.yaml

@@ -1,69 +1,73 @@
 # G7 heading-level exclusions verified against hacktricks-cloud 171e422299.
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-connect-privesc/README.md#invoke-a-privileged-flow-without-direct-lambda-or-lex-permission
-  technique: connect:StartChatContact against a privileged contact flow
-  reason: "App-plane only: the flow invokes its Lambda/Lex integrations under their own roles and returns only what the flow logic exposes; the page states it does not grant arbitrary use of the Lambda role."
-  source_revision: 171e422299
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-customer-profiles-privesc/README.md#createintegrationworkflow--iampassrole
-  technique: profile:CreateIntegrationWorkflow + iam:PassRole
-  reason: "Not a privesc: bounded service delegation; Customer Profiles uses the passed role only to create AppFlow-backed integration resources, with no credentials or arbitrary actions under the role."
-  source_revision: 171e422299
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-customer-profiles-privesc/README.md#createsegmentsnapshot--iampassrole
-  technique: profile:CreateSegmentSnapshot + iam:PassRole
-  reason: "Not a privesc: bounded data delivery; the passed role only writes the segment export to the chosen S3 destination (data exfiltration, not principal escalation)."
-  source_revision: 171e422299
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-customer-profiles-privesc/README.md#associatestreamforsegments--iampassrole
-  technique: profile:AssociateStreamForSegments + iam:PassRole
-  reason: "Not a privesc: bounded data delivery; the passed role only puts segment-membership records into the chosen Kinesis stream."
-  source_revision: 171e422299
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iot-twinmaker-privesc/README.md#connector-invocation-without-direct-lambda-permission
+- source:
+    src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iot-twinmaker-privesc/README.md#connector-invocation-without-direct-lambda-permission
   technique: iottwinmaker:CreateComponentType + CreateEntity / GetPropertyValue
-  reason: "App-plane only: TwinMaker invokes the nominated Lambda connector, which runs with its own execution role and exposes only what its code returns; the page states no generic role credentials are obtained."
+  reason: "App-plane only: TwinMaker invokes the nominated Lambda connector, which runs with its own execution role and exposes
+    only what its code returns; the page states no generic role credentials are obtained."
   source_revision: 171e422299
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iot-twinmaker-privesc/README.md#updateworkspace--iampassrole--connector-control
+- source:
+    src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iot-twinmaker-privesc/README.md#updateworkspace--iampassrole--connector-control
   technique: iottwinmaker:UpdateWorkspace + iam:PassRole
-  reason: "Not a privesc: bounded service delegation; the workspace role is used only for connector invocation and supported data sources, and the page states changing it does not expose its credentials."
+  reason: "Not a privesc: bounded service delegation; the workspace role is used only for connector invocation and supported
+    data sources, and the page states changing it does not expose its credentials."
   source_revision: 171e422299
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ivs-privesc/README.md#ivscreatestreamkey-on-stream-key---publish-to-another-channel
+- source:
+    src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ivs-privesc/README.md#ivscreatestreamkey-on-stream-key---publish-to-another-channel
   technique: ivs:CreateStreamKey
   reason: "App-plane only: a stream key is a media-plane publishing credential for a channel, not an AWS principal."
   source_revision: 171e422299
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ivs-privesc/README.md#ivsgetstreamkey-or-ivsgetingestconfiguration---convert-a-read-into-publishing-access
+- source:
+    src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ivs-privesc/README.md#ivsgetstreamkey-or-ivsgetingestconfiguration---convert-a-read-into-publishing-access
   technique: ivs:GetStreamKey / ivs:GetIngestConfiguration
   reason: "App-plane only: disclosure of a media-plane publishing credential, not an AWS principal."
   source_revision: 171e422299
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ivs-privesc/README.md#ivscreateparticipanttoken---mint-stage-publishsubscribe-access
+- source:
+    src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ivs-privesc/README.md#ivscreateparticipanttoken---mint-stage-publishsubscribe-access
   technique: ivs:CreateParticipantToken
   reason: "App-plane only: stage participant tokens grant media publish/subscribe, not an AWS principal."
   source_revision: 171e422299
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ivs-privesc/README.md#ivsimportpublickey---sign-tokens-for-stages-account-wide
+- source:
+    src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ivs-privesc/README.md#ivsimportpublickey---sign-tokens-for-stages-account-wide
   technique: ivs:ImportPublicKey
   reason: "App-plane only: lets the caller sign stage participant tokens offline; media-plane access, not an AWS principal."
   source_revision: 171e422299
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ivs-privesc/README.md#ivsimportplaybackkeypair---bypass-private-channel-playback-decisions
+- source:
+    src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ivs-privesc/README.md#ivsimportplaybackkeypair---bypass-private-channel-playback-decisions
   technique: ivs:ImportPlaybackKeyPair
   reason: "App-plane only: private-channel playback authorization tokens, not an AWS principal."
   source_revision: 171e422299
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ivs-privesc/README.md#ivsstartcomposition---send-a-stage-to-an-unauthorized-channel
+- source:
+    src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ivs-privesc/README.md#ivsstartcomposition---send-a-stage-to-an-unauthorized-channel
   technique: ivs:StartComposition
   reason: "App-plane only: routes stage media to a channel; content injection, not an AWS principal."
   source_revision: 171e422299
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lex-v2-privesc/README.md#lexcreatebotlexupdatebot--iampassrole
+- source:
+    src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lex-v2-privesc/README.md#lexcreatebotlexupdatebot--iampassrole
   technique: lex:CreateBot / lex:UpdateBot + iam:PassRole
-  reason: "Not a privesc: bounded service delegation; the bot role is used by Lex only for configured features (Lambda hooks, Kendra queries, logs), and the page states passing it does not return credentials."
+  reason: "Not a privesc: bounded service delegation; the bot role is used by Lex only for configured features (Lambda hooks,
+    Kendra queries, logs), and the page states passing it does not return credentials."
   source_revision: 171e422299
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lex-v2-privesc/README.md#existing-hook-as-a-confused-business-authority-boundary
+- source:
+    src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lex-v2-privesc/README.md#existing-hook-as-a-confused-business-authority-boundary
   technique: lex:RecognizeText / PutSession / StartConversation on a bot alias
-  reason: "App-plane only: reaches the business logic of an existing fulfillment Lambda, which keeps its own execution role; the page states it does not grant generic control of that role."
+  reason: "App-plane only: reaches the business logic of an existing fulfillment Lambda, which keeps its own execution role;
+    the page states it does not grant generic control of that role."
   source_revision: 171e422299
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-managed-blockchain-privesc/README.md#invite-an-attacker-account-into-a-hyperledger-fabric-network
+- source:
+    src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-managed-blockchain-privesc/README.md#invite-an-attacker-account-into-a-hyperledger-fabric-network
   technique: managedblockchain:CreateProposal + VoteOnProposal
-  reason: "App-plane only: yields an attacker-owned Fabric consortium member, not an AWS principal in either account (the page states it is not elevation to AWS administrator)."
+  reason: "App-plane only: yields an attacker-owned Fabric consortium member, not an AWS principal in either account (the
+    page states it is not elevation to AWS administrator)."
   source_revision: 171e422299
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-managed-grafana-privesc/README.md#grafanaupdateworkspace--iampassrole
+- source:
+    src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-managed-grafana-privesc/README.md#grafanaupdateworkspace--iampassrole
   technique: grafana:UpdateWorkspace + iam:PassRole
-  reason: "Not a privesc: bounded service delegation; the workspace role only mediates Grafana data-source and notification queries, and the page states it does not return IAM credentials."
+  reason: "Not a privesc: bounded service delegation; the workspace role only mediates Grafana data-source and notification
+    queries, and the page states it does not return IAM credentials."
   source_revision: 171e422299
-- source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-wickr-privesc/README.md#wickrcreatedataretentionbotchallenge--take-over-the-data-retention-bot
+- source:
+    src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-wickr-privesc/README.md#wickrcreatedataretentionbotchallenge--take-over-the-data-retention-bot
   technique: wickr:CreateDataRetentionBotChallenge
-  reason: "App-plane only: the challenge authenticates a data-retention bot that receives message copies; messaging data access, not an AWS principal or an application administrator."
+  reason: "App-plane only: the challenge authenticates a data-retention bot that receives message copies; messaging data access,
+    not an AWS principal or an application administrator."
   source_revision: 171e422299