aws-ebs-direct-api-write

ebs:StartSnapshot + ebs:PutSnapshotBlock + ebs:CompleteSnapshot allows an attacker to synthesize a malicious disk image for supply-chain attacks (trojanized AMI distribution). The written snapshot can be shared via ModifySnapshotAttribute to distribute the malicious disk cross-account. This rule matches on direct IAM capability evaluation, not on PENDING snapshot nodes (which are transient and not present in the graph at rule-evaluation time).

derived aws emits CanWriteData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission ebs:StartSnapshot

where

?principal has EFFECTIVE ebs:StartSnapshot (scoped to Resource: * or snapshot ARNs) ?principal has EFFECTIVE ebs:PutSnapshotBlock (scoped to Resource: * or snapshot ARNs) ?principal has EFFECTIVE ebs:CompleteSnapshot (scoped to Resource: * or snapshot ARNs)

emit

source type	`Identity`
target type	`Snapshot`
source	`?principal`
target	`<synthetic NewSnapshot node or Account boundary>`
permissions	`ebs:StartSnapshot` `ebs:PutSnapshotBlock` `ebs:CompleteSnapshot`
conditions	`iam_permission`
state logic	CONDITIONAL(iam_permission) by default: the principal CAN create a new snapshot via ebs:StartSnapshot and populate it with blocks (ebs:PutSnapshotBlock + ebs:CompleteSnapshot effective). Do NOT upgrade to ACTIVE — no snapshot node exists in the graph yet; the PENDING state is a runtime transient. Mark state_logic to document that the snapshot will be created at runtime. The downstream CanExfiltrate (sharing via ModifySnapshotAttribute) is tracked separately and depends on aws-ebs-create-and-share-snapshot or aws-ebs-share-existing-snapshot succeeding.

Narrative

{principal.name} holds ebs:StartSnapshot, ebs:PutSnapshotBlock, and ebs:CompleteSnapshot, enabling creation of a custom/malicious disk image that can be shared cross-account or made public - a supply-chain attack vector.

Raw rule rules/derived/aws/ebs.yaml

id: aws-ebs-direct-api-write
emits: CanWriteData
description: ebs:StartSnapshot + ebs:PutSnapshotBlock + ebs:CompleteSnapshot allows an attacker to synthesize
  a malicious disk image for supply-chain attacks (trojanized AMI distribution). The written snapshot
  can be shared via ModifySnapshotAttribute to distribute the malicious disk cross-account. This rule
  matches on direct IAM capability evaluation, not on PENDING snapshot nodes (which are transient and
  not present in the graph at rule-evaluation time).
match:
- - principal: null
  - HasPermission
  - ebs:StartSnapshot
where:
- '?principal has EFFECTIVE ebs:StartSnapshot (scoped to Resource: * or snapshot ARNs)'
- '?principal has EFFECTIVE ebs:PutSnapshotBlock (scoped to Resource: * or snapshot ARNs)'
- '?principal has EFFECTIVE ebs:CompleteSnapshot (scoped to Resource: * or snapshot ARNs)'
emit:
  source_type: Identity
  target_type: Snapshot
  source: ?principal
  target: <synthetic NewSnapshot node or Account boundary>
  permissions:
  - ebs:StartSnapshot
  - ebs:PutSnapshotBlock
  - ebs:CompleteSnapshot
  conditions:
  - iam_permission
  state_logic: "CONDITIONAL(iam_permission) by default: the principal CAN create a new snapshot via ebs:StartSnapshot\
    \ and populate it with blocks (ebs:PutSnapshotBlock + ebs:CompleteSnapshot effective). Do NOT upgrade\
    \ to ACTIVE \u2014 no snapshot node exists in the graph yet; the PENDING state is a runtime transient.\
    \ Mark state_logic to document that the snapshot will be created at runtime. The downstream CanExfiltrate\
    \ (sharing via ModifySnapshotAttribute) is tracked separately and depends on aws-ebs-create-and-share-snapshot\
    \ or aws-ebs-share-existing-snapshot succeeding."
  confidence: 0.8
  derived_from:
  - Direct IAM policy evaluation for ebs:StartSnapshot + ebs:PutSnapshotBlock + ebs:CompleteSnapshot
  false_positive_note: "This rule covers a supply-chain attack vector: an attacker creates a malicious\
    \ disk image and shares it, leading downstream users to mount and trust trojanized data. The CanWriteData\
    \ edge alone does not constitute exploitation \u2014 downstream CanExfiltrate derivation depends on\
    \ aws-ebs-share-existing-snapshot or aws-ebs-create-and-share-snapshot succeeding. PENDING snapshots\
    \ are temporary (abandoned snapshots expire after some time). Verify that the principal actually intends\
    \ to and CAN invoke all three actions; if the ebs:* permissions are scoped to existing snapshots only,\
    \ the principal cannot create new ones. Note: ebs:* wildcard or Resource: * in ebs policies includes\
    \ the ability to write new snapshots. Honor SCPs and permission boundaries."
  narrative: "{principal.name} holds ebs:StartSnapshot, ebs:PutSnapshotBlock, and ebs:CompleteSnapshot,\
    \ enabling creation of a custom/malicious disk image that can be shared cross-account or made public\
    \ \u2014 a supply-chain attack vector."