aws-ebs-snapshot-contains-secret
A snapshot of a volume from an instance with an instance profile (IAM role) may contain credentials, SSH keys, or other secrets on the disk. This edge is ONLY emitted when forensic evidence confirms credential material on the disk image, not from structural probability alone. The preconditions are: (1) the volume was attached to an instance with an ExecutesAs role, (2) a snapshot exists of that volume, and (3) forensic scanning or manual inspection has detected credential patterns on the disk.
match (record)
{
"evidence_field": "detective:credential_pattern_scan",
"resource_type": "AWS::EC2::Snapshot"
}
emit
| source type | Snapshot |
|---|---|
| target type | Secret |
| source | <snapshot node> |
| target | <Secret: detected credentials on snapshot> |
| state logic | ACTIVE only when forensic evidence (yara, entropy-based detection, or manual analysis) confirms credential material on the disk image. Until then, the edge is not emitted. This is an explicit edge (nature: explicit in edges.yaml) and must not be emitted by derived rules based on structural probability alone. |
Narrative
{snapshot.name} (of {volume.name} from {instance.name}) contains detected credentials via forensic scan: {evidence_field}. The credentials can be extracted by any principal who can read the snapshot data via CanReadData.
Raw rule rules/explicit/aws-ebs.yaml
id: aws-ebs-snapshot-contains-secret
emits: ContainsSecret
applies_to:
- aws
description: 'A snapshot of a volume from an instance with an instance profile (IAM role) may contain
credentials, SSH keys, or other secrets on the disk. This edge is ONLY emitted when forensic evidence
confirms credential material on the disk image, not from structural probability alone. The preconditions
are: (1) the volume was attached to an instance with an ExecutesAs role, (2) a snapshot exists of that
volume, and (3) forensic scanning or manual inspection has detected credential patterns on the disk.'
match_record:
resource_type: AWS::EC2::Snapshot
evidence_field: detective:credential_pattern_scan
emit:
source_type: Snapshot
target_type: Secret
source: <snapshot node>
target: '<Secret: detected credentials on snapshot>'
api_source: forensic:credential-pattern-scan or manual analysis
evidence_field: detective:credential_pattern_scan (file path, pattern type, confidence)
state_logic: 'ACTIVE only when forensic evidence (yara, entropy-based detection, or manual analysis)
confirms credential material on the disk image. Until then, the edge is not emitted. This is an explicit
edge (nature: explicit in edges.yaml) and must not be emitted by derived rules based on structural
probability alone.'
confidence: 'Determined by the forensic detector: 0.95+ for high-confidence patterns (e.g. AWS_ACCESS_KEY_ID=AKIA*),
0.75-0.95 for medium-confidence patterns (SSH private key PEM header), 0.50-0.75 for low-confidence
patterns (entropy spike).'
narrative: '{snapshot.name} (of {volume.name} from {instance.name}) contains detected credentials via
forensic scan: {evidence_field}. The credentials can be extracted by any principal who can read the
snapshot data via CanReadData.'