aws-ebs-volume-mount-read

CreateVolume from an existing snapshot + AttachVolume to an attacker- controlled instance yields full filesystem read of the snapshot's data. This rule matches on direct IAM capability evaluation for both volume creation and attachment.

derived aws emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanRead {'snapshot': None}

where

node_type(?snapshot) == Snapshot ?principal has EFFECTIVE ec2:CreateVolume (scoped to the snapshot or Resource: *) ?principal has EFFECTIVE ec2:AttachVolume (scoped to instances they control or Resource: *) the caller has an EC2 instance in the same AZ as the snapshot to attach the volume to

emit

source type	`Identity`
target type	`BlockStorage`
source	`?principal`
target	`volume_derived_from_?snapshot (or the snapshot itself if modeled as Storage)`
permissions	`ec2:CreateVolume` `ec2:AttachVolume`
conditions	`iam_permission` `key_permission` `region_or_boundary` `service_state`
state logic	ACTIVE when both ec2:CreateVolume (scoped to the snapshot) and ec2:AttachVolume are effective AND the caller has a running/startable instance in the snapshot's AZ to attach to. CONDITIONAL(service_state) if no attacker-controlled instance is running in the correct AZ. CONDITIONAL(key_permission) if the snapshot is CMK-encrypted and kms:Decrypt is not confirmed (CreateVolume will fail without decrypt access). CONDITIONAL(region_or_boundary) if AZ mismatch is detected or if the snapshot is in a different region than the caller's instances.

Narrative

{principal.name} can call ec2:CreateVolume from {snapshot.name} and ec2:AttachVolume to an instance under their control (in the same AZ), mounting the full disk image and reading all filesystem contents including secrets, keys, and credentials.

Raw rule rules/derived/aws/ebs.yaml

id: aws-ebs-volume-mount-read
emits: CanReadData
description: CreateVolume from an existing snapshot + AttachVolume to an attacker- controlled instance
  yields full filesystem read of the snapshot's data. This rule matches on direct IAM capability evaluation
  for both volume creation and attachment.
match:
- - principal: null
  - CanRead
  - snapshot: null
where:
- node_type(?snapshot) == Snapshot
- '?principal has EFFECTIVE ec2:CreateVolume (scoped to the snapshot or Resource: *)'
- '?principal has EFFECTIVE ec2:AttachVolume (scoped to instances they control or Resource: *)'
- the caller has an EC2 instance in the same AZ as the snapshot to attach the volume to
emit:
  source_type: Identity
  target_type: BlockStorage
  source: ?principal
  target: volume_derived_from_?snapshot (or the snapshot itself if modeled as Storage)
  permissions:
  - ec2:CreateVolume
  - ec2:AttachVolume
  conditions:
  - iam_permission
  - key_permission
  - region_or_boundary
  - service_state
  state_logic: ACTIVE when both ec2:CreateVolume (scoped to the snapshot) and ec2:AttachVolume are effective
    AND the caller has a running/startable instance in the snapshot's AZ to attach to. CONDITIONAL(service_state)
    if no attacker-controlled instance is running in the correct AZ. CONDITIONAL(key_permission) if the
    snapshot is CMK-encrypted and kms:Decrypt is not confirmed (CreateVolume will fail without decrypt
    access). CONDITIONAL(region_or_boundary) if AZ mismatch is detected or if the snapshot is in a different
    region than the caller's instances.
  confidence: 0.88
  derived_from:
  - <CanRead edge on ?snapshot>
  - Direct IAM evaluation of ec2:CreateVolume + ec2:AttachVolume
  false_positive_note: 'This rule requires THREE concurrent preconditions: (1) ec2:CreateVolume scoped
    to the snapshot or to all volumes (*), (2) ec2:AttachVolume scoped to instances the principal controls
    or all instances (*), and (3) an attacker-controlled instance running in the same AZ as the snapshot.
    If any is missing, downgrade to CONDITIONAL. The CanRead anchor edge is sufficient; direct IAM evaluation
    then confirms the two ebs/ec2 permissions. ec2:CreateVolume from a CMK-encrypted snapshot requires
    that the caller''s role can call kms:Decrypt (or kms:CreateGrant) on the KMS key used to encrypt the
    snapshot. The volume attachment AZ must match the snapshot''s AZ; cross-AZ attach is not possible.
    Do not emit ACTIVE without confirming AZ alignment or marking it CONDITIONAL(region_or_boundary).'
  narrative: '{principal.name} can call ec2:CreateVolume from {snapshot.name} and ec2:AttachVolume to
    an instance under their control (in the same AZ), mounting the full disk image and reading all filesystem
    contents including secrets, keys, and credentials.'