aws-ebs-share-existing-snapshot

ModifySnapshotAttribute on an existing snapshot to add a cross-account createVolumePermission entry - data exfiltration without CreateSnapshot.

derived aws emits CanExfiltrate

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Snapshot`
source	`?principal`
target	`?snapshot`
permissions	`ec2:ModifySnapshotAttribute`
conditions	`iam_permission`
state logic	ACTIVE when ec2:ModifySnapshotAttribute is confirmed effective (IAM + no SCP deny); CONDITIONAL(iam_permission) if scoping is unresolved. For a public share (add=all), the emitted edge feeds the ExposedToInternet explicit edge (see aws-ebs-make-snapshot-public).

source type

Identity

target type

Snapshot

source

?principal

target

?snapshot

permissions

ec2:ModifySnapshotAttribute

conditions

iam_permission

state logic

ACTIVE when ec2:ModifySnapshotAttribute is confirmed effective (IAM + no SCP deny); CONDITIONAL(iam_permission) if scoping is unresolved. For a public share (add=all), the emitted edge feeds the ExposedToInternet explicit edge (see aws-ebs-make-snapshot-public).

Narrative

{principal.name} can share {snapshot.name} to an attacker-controlled account via ec2:ModifySnapshotAttribute, enabling full disk access to the snapshot data outside the account boundary.

Raw rule rules/derived/aws/ebs.yaml

id: aws-ebs-share-existing-snapshot
emits: CanExfiltrate
description: "ModifySnapshotAttribute on an existing snapshot to add a cross-account createVolumePermission\
  \ entry \u2014 data exfiltration without CreateSnapshot."
match:
- - principal: null
  - CanModify
  - snapshot: null
where:
- node_type(?snapshot) == Snapshot
- ?principal has EFFECTIVE ec2:ModifySnapshotAttribute on ?snapshot
- the modification target is an account != snapshot owner account (or 'all')
emit:
  source_type: Identity
  target_type: Snapshot
  source: ?principal
  target: ?snapshot
  permissions:
  - ec2:ModifySnapshotAttribute
  conditions:
  - iam_permission
  state_logic: ACTIVE when ec2:ModifySnapshotAttribute is confirmed effective (IAM + no SCP deny); CONDITIONAL(iam_permission)
    if scoping is unresolved. For a public share (add=all), the emitted edge feeds the ExposedToInternet
    explicit edge (see aws-ebs-make-snapshot-public).
  confidence: 0.92
  derived_from:
  - <CanModify edge on ?snapshot>
  false_positive_note: "ec2:ModifySnapshotAttribute must be effective on the specific snapshot ARN; an\
    \ attacker-accessible snapshot in a different account is not in scope unless the principal holds the\
    \ permission across that account. KMS-encrypted snapshots: sharing the snapshot alone does not decrypt\
    \ data in the target account without the CMK being shared \u2014 downgrade target account's CanReadData\
    \ to CONDITIONAL(key_permission)."
  narrative: '{principal.name} can share {snapshot.name} to an attacker-controlled account via ec2:ModifySnapshotAttribute,
    enabling full disk access to the snapshot data outside the account boundary.'