rage.fail

aws-ec2-share-ami

derived aws emits CanExfiltrate

match (effective permission)

{ "action": "ec2:ModifyImageAttribute", "resource_type": "AWS::EC2::Image" }

where

launchPermission add == external account or 'all'

emit

source	`<principal>`
target	`<AMI in scope>`
permissions	`ec2:ModifyImageAttribute`

Narrative

{principal.name} can share AMI {image.name} with an external account (ec2:ModifyImageAttribute launchPermission), exposing its baked-in disk data.

Raw rule rules/derived/aws/ec2.yaml

id: aws-ec2-share-ami
emits: CanExfiltrate
match_effective_permission:
  action: ec2:ModifyImageAttribute
  resource_type: AWS::EC2::Image
where:
- launchPermission add == external account or 'all'
emit:
  source: <principal>
  target: <AMI in scope>
  permissions:
  - ec2:ModifyImageAttribute
  cross_account: adds launchPermission for another account / 'all'
  false_positive_note: AMIs embed the source instance's disk (incl. any baked-in secrets/UserData). Emit
    exfil only when launchPermission is widened to an external/attacker account or 'all'.
  narrative: '{principal.name} can share AMI {image.name} with an external account (ec2:ModifyImageAttribute
    launchPermission), exposing its baked-in disk data.'