From 063a8a8b5addd7f75473ffdeca81c8816845066b Mon Sep 17 00:00:00 2001
From: Translator <github-actions@github.com>
Date: Thu, 23 Oct 2025 21:53:52 +0000
Subject: [PATCH] Translated
 ['src/pentesting-cloud/aws-security/aws-post-exploitation/aws

---
 .../aws-mwaa-post-exploitation/README.md      | 44 +++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 src/pentesting-cloud/aws-security/aws-post-exploitation/aws-mwaa-post-exploitation/README.md

diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-mwaa-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-mwaa-post-exploitation/README.md
new file mode 100644
index 000000000..36b9ba7b5
--- /dev/null
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-mwaa-post-exploitation/README.md
@@ -0,0 +1,44 @@
+# Udhaifu wa Wildcard wa Akaunti ya Execution Role ya AWS MWAA
+
+## Udhaifu
+
+Execution role ya MWAA (IAM role ambayo wafanyakazi wa Airflow hutumia kufikia rasilimali za AWS) inahitaji sera hii ya lazima ili ifanye kazi:
+```json
+{
+"Effect": "Allow",
+"Action": [
+"sqs:ChangeMessageVisibility",
+"sqs:DeleteMessage",
+"sqs:GetQueueAttributes",
+"sqs:GetQueueUrl",
+"sqs:ReceiveMessage",
+"sqs:SendMessage"
+],
+"Resource": "arn:aws:sqs:us-east-1:*:airflow-celery-*"
+}
+```
+The wildcard (`*`) in the account ID position allows the role to interact with **any SQS queue in any AWS account** that starts with `airflow-celery-`. This is required because AWS provisions MWAA's internal queues in a separate AWS-managed account. There is no restriction on making queues with the `airflow-celery-` prefix.
+
+**Haiwezi kurekebishwa:** Kuondoa wildcard kabla ya deployment kunavunja MWAA kabisa - scheduler hawezi kuweka tasks kwenye queue kwa workers.
+
+Nyaraka zinazo-thibitisha udhaifu na kutambua vektori: [AWS Documentation](https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-create-role.html)
+
+## Exploitation
+
+DAG zote za Airflow zinaendeshwa kwa ruhusa za execution role. DAGs ni scripts za Python zinazoweza kutekeleza code yoyote - zinaweza kutumia `yum` au `curl` kusanidi tools, kupakua scripts zenye madhara, au kuingiza maktaba yoyote ya Python. DAGs huzuliwa kutoka kwa folda iliyoteuliwa kwenye S3 na zinaendeshwa kwa ratiba moja kwa moja; kila msaliti anahitaji ni uwezo wa kufanya PUT kwenye path ya bucket hiyo.
+
+Mtu yeyote anayejua kuandika DAGs (kawaida watumiaji wengi katika mazingira ya MWAA) anaweza kutumia vibaya ruhusa hii:
+
+1. **Data Exfiltration**: Tengeneza queue iitwayo `airflow-celery-exfil` katika external account, andika DAG inayotuma data nyeti kwa kutumia `boto3`
+
+2. **Command & Control**: Poll commands kutoka kwa external queue, zitekeleze, rudisha matokeo - kuunda backdoor ya kudumu kupitia SQS APIs
+
+3. **Cross-Account Attacks**: Weka ujumbe wenye madhara ndani ya queues za mashirika mengine ikiwa zinafuata muundo wa majina
+
+Mashambulizi yote yanapita juu ya udhibiti wa mtandao kwa sababu yanatumia AWS APIs, si muunganisho wa moja kwa moja wa intaneti.
+
+## Impact
+
+Hii ni kasoro ya usanifu katika MWAA bila mbinu ya kuepukika kwa kutumia IAM. Kila deployment ya MWAA inayofuata nyaraka za AWS ina udhaifu huu.
+
+**Network Control Bypass:** Mashambulizi haya hufanya kazi hata katika private VPCs zisizo na ufikaji wa intaneti. Mito ya SQS API inatumia mtandao wa ndani wa AWS na VPC endpoints, ikipita kabisa udhibiti wa kawaida wa usalama wa mtandao, firewalls, na egress monitoring. Mashirika hayawezi kugundua au kuzuia njia hii ya data exfiltration kupitia udhibiti wa ngazi ya mtandao.