rage.fail

aws-ec2-share-snapshot

derived aws emits CanExfiltrate

match (effective permission)

{ "action": "ec2:ModifySnapshotAttribute", "resource_type": "AWS::EC2::Snapshot" }

emit

source	`<principal>`
target	`<EBS snapshot in scope>`
permissions	`ec2:ModifySnapshotAttribute`

Narrative

{principal.name} can share snapshot {snapshot.name} with an external account (ec2:ModifySnapshotAttribute createVolumePermission), exfiltrating its disk contents.

Raw rule rules/derived/aws/ec2.yaml

id: aws-ec2-share-snapshot
emits: CanExfiltrate
match_effective_permission:
  action: ec2:ModifySnapshotAttribute
  resource_type: AWS::EC2::Snapshot
emit:
  source: <principal>
  target: <EBS snapshot in scope>
  permissions:
  - ec2:ModifySnapshotAttribute
  cross_account: adding createVolumePermission for another account or 'all' moves disk data out of the
    boundary; also emits CrossAccountTrust-style exposure
  false_positive_note: Exfil realized only when the added principal is an attacker-controlled account
    or 'all'. Sharing a snapshot with no sensitive data is low value; scope to snapshots of role/secret-bearing
    volumes.
  narrative: '{principal.name} can share snapshot {snapshot.name} with an external account (ec2:ModifySnapshotAttribute
    createVolumePermission), exfiltrating its disk contents.'