aws-ebs-make-snapshot-public

A principal with ec2:ModifySnapshotAttribute can make a snapshot world-readable (any AWS account can CreateVolume from it).

derived aws emits ExposedToInternet

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Snapshot`
target type	`AnonymousIdentity`
source	`?snapshot`
target	`<AnonymousIdentity>`
permissions	`ec2:ModifySnapshotAttribute`
conditions	`iam_permission`
state logic	ACTIVE when the snapshot already carries createVolumePermission=all (observed in DescribeSnapshotAttribute response). POTENTIAL when the principal CAN set it to 'all' via ec2:ModifySnapshotAttribute but has not yet done so. An AWS Organizations SCP restricting ec2:ModifySnapshotAttribute or a Block Public Access setting at the account level with 'block-all-sharing' mode makes this BLOCKED. Note: 'block-new-sharing' mode only prevents NEW shares; existing public snapshots remain accessible unless the mode is later changed to 'block-all-sharing'.

source type

Snapshot

target type

AnonymousIdentity

source

?snapshot

target

<AnonymousIdentity>

permissions

ec2:ModifySnapshotAttribute

conditions

iam_permission

state logic

ACTIVE when the snapshot already carries createVolumePermission=all (observed in DescribeSnapshotAttribute response). POTENTIAL when the principal CAN set it to 'all' via ec2:ModifySnapshotAttribute but has not yet done so. An AWS Organizations SCP restricting ec2:ModifySnapshotAttribute or a Block Public Access setting at the account level with 'block-all-sharing' mode makes this BLOCKED. Note: 'block-new-sharing' mode only prevents NEW shares; existing public snapshots remain accessible unless the mode is later changed to 'block-all-sharing'.

Narrative

{principal.name} can set createVolumePermission=all on {snapshot.name} via ec2:ModifySnapshotAttribute, making the snapshot publicly accessible to any AWS account worldwide (if not already public).

Raw rule rules/derived/aws/ebs.yaml

id: aws-ebs-make-snapshot-public
emits: ExposedToInternet
description: A principal with ec2:ModifySnapshotAttribute can make a snapshot world-readable (any AWS
  account can CreateVolume from it).
match:
- - principal: null
  - CanModify
  - snapshot: null
where:
- node_type(?snapshot) == Snapshot
- ?principal has EFFECTIVE ec2:ModifySnapshotAttribute on ?snapshot
- 'the createVolumePermission add set includes ''all'' (or POTENTIAL: principal CAN set it to all)'
emit:
  source_type: Snapshot
  target_type: AnonymousIdentity
  source: ?snapshot
  target: <AnonymousIdentity>
  permissions:
  - ec2:ModifySnapshotAttribute
  conditions:
  - iam_permission
  state_logic: 'ACTIVE when the snapshot already carries createVolumePermission=all (observed in DescribeSnapshotAttribute
    response). POTENTIAL when the principal CAN set it to ''all'' via ec2:ModifySnapshotAttribute but
    has not yet done so. An AWS Organizations SCP restricting ec2:ModifySnapshotAttribute or a Block Public
    Access setting at the account level with ''block-all-sharing'' mode makes this BLOCKED. Note: ''block-new-sharing''
    mode only prevents NEW shares; existing public snapshots remain accessible unless the mode is later
    changed to ''block-all-sharing''.'
  confidence: 0.92 if ACTIVE (observed), 0.70 if POTENTIAL (capability only)
  derived_from:
  - <CanModify edge on ?snapshot>
  - ec2:DescribeSnapshotAttribute
  false_positive_note: "AWS Snapshot Block Public Access (available since Nov 2023) can restrict this\
    \ at account or organization level. Check the BlockPublicAccessState setting via ec2:GetSnapshotBlockPublicAccessState\
    \ (READ action; NOT DisableSnapshotBlockPublicAccess which is a WRITE action that toggles the setting).\
    \ Two blocking modes exist: - 'block-all-sharing': retroactively makes existing public snapshots inaccessible\n\
    \  (BLOCKED).\n- 'block-new-sharing': only prevents NEW shares; snapshots already public before\n\
    \  this setting was applied remain accessible under this mode (NOT BLOCKED, but the\n  principal cannot\
    \ make NEW snapshots public). A CMK-encrypted snapshot that is\n  made public is still opaque without\
    \ the key being shared \u2014 note this but still\n  emit ExposedToInternet (the snapshot permission\
    \ itself is the exposure)."
  narrative: '{principal.name} can set createVolumePermission=all on {snapshot.name} via ec2:ModifySnapshotAttribute,
    making the snapshot publicly accessible to any AWS account worldwide (if not already public).'