AWS Execution Roles Enable Subtle Privilege Escalation in SageMaker and EC2

This report details a persistent privilege-escalation technique against AWS compute services where attackers who can stop/start instances or notebooks and modify boot or lifecycle configurations inject scripts (via EC2 userData #cloud-boothook or SageMaker lifecycle configs) that execute under the instance/notebook execution role, enabling credential exfiltration and misuse of privileged permissions; it cites proof-of-concept code, CloudTrail detection patterns (Stop → Modify → Start), and recommends restricting config-modification permissions, using SCPs and approval workflows to mitigate the risk.