aws-ec2-mount-snapshot

id: aws-ec2-mount-snapshot
emits: CanReadData
description: Snapshot a peer instance's volume, create a volume from it, attach to an attacker instance
  and mount -> read on-disk secrets/keys without running code on the victim.
match_effective_permission:
  action: ec2:CreateSnapshot
  resource_type: AWS::EC2::Volume
where:
- ?principal has EFFECTIVE ec2:CreateSnapshot on the target volume AND ec2:CreateVolume AND ec2:AttachVolume
  to an attacker-controlled instance
emit:
  source: <principal>
  target: <peer instance's EBS volume / on-disk data>
  permissions:
  - ec2:CreateSnapshot
  - ec2:CreateVolume
  - ec2:AttachVolume
  conditions:
  - iam_permission
  - key_permission
  escalation: Copy a peer instance's disk (CreateSnapshot -> CreateVolume -> AttachVolume to an attacker
    instance -> OS mount) and read its filesystem, harvesting SSH keys, credential files, and application
    secrets without ever executing code on the victim.
  state_logic: ACTIVE if all three actions (CreateSnapshot, CreateVolume, AttachVolume) are effective
    and the volume is unencrypted or the attacker holds kms:Decrypt on its CMK; else CONDITIONAL(key_permission)
    when the volume is encrypted with a key the attacker cannot use, or POTENTIAL(iam_permission) when
    any action is missing.
  false_positive_note: Requires all three EBS actions plus an attacker-controlled instance to attach to.
    An encrypted volume also requires kms:Decrypt / kms:CreateGrant on its CMK to mount and read -> otherwise
    CONDITIONAL(key_permission). Reading the disk yields whatever secrets are stored on it; if none, low
    value.
  narrative: '{principal.name} can snapshot volume {volume.name}, create a volume from it and attach it
    to an attacker instance (ec2:CreateSnapshot + ec2:CreateVolume + ec2:AttachVolume), then mount and
    read on-disk secrets/keys of {instance.name}.'