aws-cloudfront-create-distribution-config

A principal with cloudfront:CreateDistribution can create new distributions pointing at any origin (S3 bucket, ALB, API Gateway, custom endpoint). If an S3 bucket has an overly-broad OAC policy grant (missing aws:SourceArn condition), the attacker can create a distribution to expose its contents publicly.

derived aws emits CanCreate

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`PublicEndpoint`
source	`?principal`
target	`<new CloudFront distribution (to be created)>`
permissions	`cloudfront:CreateDistribution`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when effective-permission evaluator confirms cloudfront:CreateDistribution on the account resource (or a wildcard resource). BLOCKED if an SCP or permission boundary explicitly denies cloudfront:CreateDistribution. As with UpdateDistribution, CloudFront is us-east-1-only — an SCP denying any CloudFront action with aws:RequestedRegion excluding us-east-1 blocks this capability.

source type

Identity

target type

PublicEndpoint

source

?principal

target

<new CloudFront distribution (to be created)>

permissions

cloudfront:CreateDistribution

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE when effective-permission evaluator confirms cloudfront:CreateDistribution on the account resource (or a wildcard resource). BLOCKED if an SCP or permission boundary explicitly denies cloudfront:CreateDistribution. As with UpdateDistribution, CloudFront is us-east-1-only — an SCP denying any CloudFront action with aws:RequestedRegion excluding us-east-1 blocks this capability.

Narrative

{principal.name} can call cloudfront:CreateDistribution and create new CloudFront distributions. Combined with an overly-broad S3 bucket OAC policy (missing aws:SourceArn condition), the attacker can create a distribution to expose that private bucket's contents publicly.

Raw rule rules/derived/aws/cloudfront.yaml

id: aws-cloudfront-create-distribution-config
emits: CanCreate
description: A principal with cloudfront:CreateDistribution can create new distributions pointing at any
  origin (S3 bucket, ALB, API Gateway, custom endpoint). If an S3 bucket has an overly-broad OAC policy
  grant (missing aws:SourceArn condition), the attacker can create a distribution to expose its contents
  publicly.
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - account: null
where:
- node_type(?account) == AdministrativeBoundary
- ?account.provider_type == 'AWS::Account'
- effective_action_on(?principal, ?account) contains 'cloudfront:CreateDistribution'
emit:
  source_type: Identity
  target_type: PublicEndpoint
  source: ?principal
  target: <new CloudFront distribution (to be created)>
  permissions:
  - cloudfront:CreateDistribution
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: "ACTIVE when effective-permission evaluator confirms cloudfront:CreateDistribution on the\
    \ account resource (or a wildcard resource). BLOCKED if an SCP or permission boundary explicitly denies\
    \ cloudfront:CreateDistribution. As with UpdateDistribution, CloudFront is us-east-1-only \u2014 an\
    \ SCP denying any CloudFront action with aws:RequestedRegion excluding us-east-1 blocks this capability."
  confidence: 0.85
  derived_from:
  - ?principal HasPermission ?account (cloudfront:CreateDistribution)
  false_positive_note: "CanCreate here models the capability to create a new distribution, not a specific\
    \ instance. The attack surface emerges when combined with an S3 bucket policy that has an unscoped\
    \ OAC grant (missing aws:SourceArn condition) \u2014 the attacker creates a distribution pointing\
    \ to that bucket, exposing it publicly. This is distinct from UpdateDistribution (modify an existing\
    \ distribution's origin). cloudfront.md Section 4 documents CreateDistribution explicitly."
  narrative: '{principal.name} can call cloudfront:CreateDistribution and create new CloudFront distributions.
    Combined with an overly-broad S3 bucket OAC policy (missing aws:SourceArn condition), the attacker
    can create a distribution to expose that private bucket''s contents publicly.'