aws-dynamodb-enable-pitr-then-exfil

dynamodb:UpdateContinuousBackups (enable PITR) + dynamodb:ExportTableToPointInTime yields full-table exfiltration even if PITR is currently disabled - two-step escalation.

derived aws emits CanExfiltrate

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'table': None}

where

node_type(?table) == NoSQLDatabase ?table.provider_type in ['AWS::DynamoDB::Table', 'AWS::DynamoDB::GlobalTable'] ?principal has EFFECTIVE dynamodb:UpdateContinuousBackups on ?table ARN ?principal has EFFECTIVE dynamodb:ExportTableToPointInTime on ?table ARN ?table.properties.PointInTimeRecoveryStatus == 'DISABLED' or unknown

emit

source type	`Identity`
target type	`NoSQLDatabase`
source	`?principal`
target	`?table`
permissions	`dynamodb:UpdateContinuousBackups` `dynamodb:ExportTableToPointInTime`
conditions	`iam_permission` `scp_or_org_policy` `service_state`
state logic	CONDITIONAL(service_state) when PITR is currently DISABLED on the table. The principal first calls UpdateContinuousBackups(PointInTimeRecoveryEnabled=true), which transitions PointInTimeRecoveryStatus to ENABLED (may take seconds to minutes). Once ENABLED, ExportTableToPointInTime becomes callable (cf. aws-dynamodb-exfil-export). ACTIVE if PITR is already ENABLED — in that case use aws-dynamodb-exfil-export instead. BLOCKED by an SCP or permission-boundary deny on either UpdateContinuousBackups or ExportTableToPointInTime.

Narrative

{principal.name} can enable PITR on {table.name} (dynamodb:UpdateContinuousBackups) and then export the full table to S3 (dynamodb:ExportTableToPointInTime), achieving table exfiltration even if PITR was initially disabled.

Raw rule rules/derived/aws/dynamodb.yaml

id: aws-dynamodb-enable-pitr-then-exfil
emits: CanExfiltrate
description: "dynamodb:UpdateContinuousBackups (enable PITR) + dynamodb:ExportTableToPointInTime yields\
  \ full-table exfiltration even if PITR is currently disabled \u2014 two-step escalation."
match:
- - principal: null
  - HasPermission
  - table: null
where:
- node_type(?table) == NoSQLDatabase
- ?table.provider_type in ['AWS::DynamoDB::Table', 'AWS::DynamoDB::GlobalTable']
- ?principal has EFFECTIVE dynamodb:UpdateContinuousBackups on ?table ARN
- ?principal has EFFECTIVE dynamodb:ExportTableToPointInTime on ?table ARN
- ?table.properties.PointInTimeRecoveryStatus == 'DISABLED' or unknown
emit:
  source_type: Identity
  target_type: NoSQLDatabase
  source: ?principal
  target: ?table
  permissions:
  - dynamodb:UpdateContinuousBackups
  - dynamodb:ExportTableToPointInTime
  conditions:
  - iam_permission
  - scp_or_org_policy
  - service_state
  state_logic: "CONDITIONAL(service_state) when PITR is currently DISABLED on the table. The principal\
    \ first calls UpdateContinuousBackups(PointInTimeRecoveryEnabled=true), which transitions PointInTimeRecoveryStatus\
    \ to ENABLED (may take seconds to minutes). Once ENABLED, ExportTableToPointInTime becomes callable\
    \ (cf. aws-dynamodb-exfil-export). ACTIVE if PITR is already ENABLED \u2014 in that case use aws-dynamodb-exfil-export\
    \ instead. BLOCKED by an SCP or permission-boundary deny on either UpdateContinuousBackups or ExportTableToPointInTime."
  confidence: min(contributing_confidences) * 0.90
  derived_from:
  - ?principal HasPermission ?table (dynamodb:UpdateContinuousBackups + ExportTableToPointInTime effective)
  - ?table PointInTimeRecoveryStatus == DISABLED or unknown
  false_positive_note: "This rule fires only when PITR is DISABLED or unknown. When PITR is already ENABLED,\
    \ aws-dynamodb-exfil-export emits ACTIVE exfiltration without this gate. The UpdateContinuousBackups\
    \ call has a state transition cost (seconds to minutes); the exfil path is real but requires an enabling\
    \ step. Both permissions must be EFFECTIVE; if either is missing or denied, no escalation. Note: UpdateContinuousBackups\
    \ is a PointInTimeRecoveryUpdate API call; SSE on the table is unaffected \u2014 the export still\
    \ decrypts and writes plaintext to S3 (or re-encrypts with S3 bucket SSE)."
  narrative: '{principal.name} can enable PITR on {table.name} (dynamodb:UpdateContinuousBackups) and
    then export the full table to S3 (dynamodb:ExportTableToPointInTime), achieving table exfiltration
    even if PITR was initially disabled.'