aws-accessanalyzer-list-findings

List findings on an Access Analyzer to map which account resources are externally or publicly accessible and which external principals hold access grants - recon that identifies targets for further attack-path traversal.

derived aws emits CanRead

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'analyzer': None}

where

node_class(?analyzer) == ManagementService node_type(?analyzer) == SecurityService ?analyzer.origin_service == aws:accessanalyzer ?principal has EFFECTIVE access-analyzer:ListFindings OR access-analyzer:ListFindingsV2 OR access-analyzer:GetFinding on ?analyzer ARN scope

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?analyzer`
permissions	`access-analyzer:ListFindings` `access-analyzer:ListFindingsV2` `access-analyzer:GetFinding`
conditions	`iam_permission`
state logic	ACTIVE when the principal holds effective access-analyzer:ListFindings, ListFindingsV2, or GetFinding on the analyzer ARN scope and at least one analyzer is active in the account; CONDITIONAL(iam_permission) when the grant is present but the analyzer does not yet exist or is in a pending state; BLOCKED when an SCP or permission boundary explicitly denies the action at the effective scope.

Narrative

{principal.name} can call access-analyzer:ListFindings (or ListFindingsV2) on {analyzer.name}, revealing which resources in this account are externally or publicly accessible and which external principals hold access grants. This provides a ready-made map of external-access attack paths for further traversal.

Raw rule rules/derived/aws/accessanalyzer.yaml

id: aws-accessanalyzer-list-findings
emits: CanRead
description: "List findings on an Access Analyzer to map which account resources are externally or publicly\
  \ accessible and which external principals hold access grants \u2014 recon that identifies targets for\
  \ further attack-path traversal."
match:
- - principal: null
  - HasPermission
  - analyzer: null
where:
- node_class(?analyzer) == ManagementService
- node_type(?analyzer) == SecurityService
- ?analyzer.origin_service == aws:accessanalyzer
- ?principal has EFFECTIVE access-analyzer:ListFindings OR access-analyzer:ListFindingsV2 OR access-analyzer:GetFinding
  on ?analyzer ARN scope
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?analyzer
  permissions:
  - access-analyzer:ListFindings
  - access-analyzer:ListFindingsV2
  - access-analyzer:GetFinding
  conditions:
  - iam_permission
  state_logic: ACTIVE when the principal holds effective access-analyzer:ListFindings, ListFindingsV2,
    or GetFinding on the analyzer ARN scope and at least one analyzer is active in the account; CONDITIONAL(iam_permission)
    when the grant is present but the analyzer does not yet exist or is in a pending state; BLOCKED when
    an SCP or permission boundary explicitly denies the action at the effective scope.
  confidence: 0.9
  derived_from:
  - ?principal HasPermission access-analyzer:ListFindings|ListFindingsV2|GetFinding on ?analyzer
  false_positive_note: "CanRead here is a RECON edge only. ListFindings / ListFindingsV2 / GetFinding\
    \ all reveal externally accessible resources and external principals that have access grants, but\
    \ do NOT grant access to those resources themselves. Do NOT chain this edge into CanEnterAccount,\
    \ CanAssume, or CanEscalateTo \u2014 the attack paths are on the resources the findings describe,\
    \ not on the analyzer itself. GetFinding provides richer intelligence (per-finding detail including\
    \ full external principal ARN and policy excerpt) than list-level results and is treated as equivalent\
    \ recon capability. An org-scoped analyzer (zone_of_trust: ORGANIZATION) magnifies the recon blast\
    \ radius (findings span all member accounts) but still does not grant cross-account access; note the\
    \ org scope in findings metadata only."
  narrative: '{principal.name} can call access-analyzer:ListFindings (or ListFindingsV2) on {analyzer.name},
    revealing which resources in this account are externally or publicly accessible and which external
    principals hold access grants. This provides a ready-made map of external-access attack paths for
    further traversal.'