aws-athena-output-location-hijack

athena:UpdateWorkGroup lets a principal rewrite the workgroup output S3 location, redirecting subsequent users' query results to an attacker-controlled bucket.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`AnalyticsService`
source	`?principal`
target	`?workgroup`
permissions	`athena:UpdateWorkGroup`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when athena:UpdateWorkGroup is confirmed EFFECTIVE on ?workgroup ARN (identity-based policy + no SCP deny + no explicit deny). CONDITIONAL (scp_or_org_policy) when an SCP may restrict the action. BLOCKED by an explicit deny on athena:UpdateWorkGroup.

source type

Identity

target type

AnalyticsService

source

?principal

target

?workgroup

permissions

athena:UpdateWorkGroup

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE when athena:UpdateWorkGroup is confirmed EFFECTIVE on ?workgroup ARN (identity-based policy + no SCP deny + no explicit deny). CONDITIONAL (scp_or_org_policy) when an SCP may restrict the action. BLOCKED by an explicit deny on athena:UpdateWorkGroup.

Narrative

{principal.name} has athena:UpdateWorkGroup on workgroup {workgroup.name} and can rewrite its query-results output S3 location. All subsequent queries submitted to {workgroup.name} by any user will write results to the new location - which the attacker controls. data-plane rules then produce CanExfiltrate over those redirected result objects.

Raw rule rules/derived/aws/athena.yaml

id: aws-athena-output-location-hijack
emits: CanModifyConfiguration
description: athena:UpdateWorkGroup lets a principal rewrite the workgroup output S3 location, redirecting
  subsequent users' query results to an attacker-controlled bucket.
match:
- - principal: null
  - HasPermission
  - workgroup: null
where:
- node_type(?workgroup) == AnalyticsService
- ?workgroup.provider_type == 'AWS::Athena::WorkGroup'
- ?principal has EFFECTIVE athena:UpdateWorkGroup on ?workgroup ARN
emit:
  source_type: Identity
  target_type: AnalyticsService
  source: ?principal
  target: ?workgroup
  permissions:
  - athena:UpdateWorkGroup
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when athena:UpdateWorkGroup is confirmed EFFECTIVE on ?workgroup ARN (identity-based
    policy + no SCP deny + no explicit deny). CONDITIONAL (scp_or_org_policy) when an SCP may restrict
    the action. BLOCKED by an explicit deny on athena:UpdateWorkGroup.
  confidence: min(contributing_confidences)
  derived_from:
  - ?principal HasPermission ?workgroup (athena:UpdateWorkGroup effective permission)
  false_positive_note: "This edge is the MODIFY FACT only; CanExfiltrate over redirected results is produced\
    \ downstream by data-plane rules \u2014 do not emit CanExfiltrate here. IMPORTANT: Distinguish two\
    \ different output-location override paths: (a) CLIENT-SIDE override: a query caller specifies a different\
    \ output location\n    at StartQueryExecution time \u2014 BLOCKED by EnforceWorkGroupConfiguration:\
    \ true.\n(b) SERVER-SIDE override via UpdateWorkGroup: the attacker calls\n    athena:UpdateWorkGroup\
    \ to change the workgroup's enforced output location\n    (Configuration.ResultConfiguration.OutputLocation)\
    \ \u2014 NOT blocked by\n    EnforceWorkGroupConfiguration: true; that flag only blocks (a).\nThis\
    \ rule emits edge for (b): UpdateWorkGroup rewrites the workgroup's own output location, forcing all\
    \ subsequent queries to use the new location. Therefore EnforceWorkGroupConfiguration does NOT prevent\
    \ this attack path \u2014 it does not gate this edge (it only blocks caller-side overrides). Honor\
    \ SCP/deny on athena:UpdateWorkGroup as a real control."
  narrative: "{principal.name} has athena:UpdateWorkGroup on workgroup {workgroup.name} and can rewrite\
    \ its query-results output S3 location. All subsequent queries submitted to {workgroup.name} by any\
    \ user will write results to the new location \u2014 which the attacker controls. data-plane rules\
    \ then produce CanExfiltrate over those redirected result objects."