rage.fail

aws-ec2-mount-snapshot-exposes-cred

The mounted peer volume leaks any on-disk credentials/keys to the attacker who mounted it.

derived aws emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanReadData {'volume': None}

where

the mounted volume contains credential material (SSH private keys, ~/.aws/credentials, app secrets)

emit

source	`<peer instance's EBS volume>`
target	`<embedded credential/identity on disk>`
conditions	`iam_permission`

Narrative

The mounted volume of {instance.name} exposes on-disk credentials (SSH keys / AWS credential files / app secrets) to {principal.name}.

Raw rule rules/derived/aws/ec2.yaml

id: aws-ec2-mount-snapshot-exposes-cred
emits: ExposesCredential
description: The mounted peer volume leaks any on-disk credentials/keys to the attacker who mounted it.
match:
- - principal: null
  - CanReadData
  - volume: null
where:
- the mounted volume contains credential material (SSH private keys, ~/.aws/credentials, app secrets)
emit:
  source: <peer instance's EBS volume>
  target: <embedded credential/identity on disk>
  permissions: []
  conditions:
  - iam_permission
  false_positive_note: Only emit when the disk actually holds secret material; requires content inspection
    of the mounted filesystem, not mere ability to mount. Chains from aws-ec2-mount-snapshot's CanReadData
    on the same volume.
  narrative: The mounted volume of {instance.name} exposes on-disk credentials (SSH keys / AWS credential
    files / app secrets) to {principal.name}.