aws-efs-can-create-mount-target

A principal with elasticfilesystem:CreateMountTarget can place a new mount target in a subnet they control, gaining network access to the EFS file system.

explicit aws emits CanNetworkReach

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`FileStorage`
source	`?principal`
target	`?filesystem`
permissions	`elasticfilesystem:CreateMountTarget`
conditions	`iam_permission` `scp_or_org_policy` `permission_boundary`
state logic	ACTIVE — the principal can immediately create a new mount target in a subnet of their choice (typically one they control or have network access to). This enables them to reach the EFS file system on port 2049 from their network. CONDITIONAL if the principal must obtain network access to the EFS VPC first (e.g., via VPC peering). BLOCKED if an SCP or permission boundary denies elasticfilesystem:CreateMountTarget.

source type

Identity

target type

FileStorage

source

?principal

target

?filesystem

permissions

elasticfilesystem:CreateMountTarget

conditions

iam_permission scp_or_org_policy permission_boundary

state logic

ACTIVE — the principal can immediately create a new mount target in a subnet of their choice (typically one they control or have network access to). This enables them to reach the EFS file system on port 2049 from their network. CONDITIONAL if the principal must obtain network access to the EFS VPC first (e.g., via VPC peering). BLOCKED if an SCP or permission boundary denies elasticfilesystem:CreateMountTarget.

Narrative

{principal.name} holds elasticfilesystem:CreateMountTarget on {filesystem.name} and can create a new mount target in a subnet they control, gaining NFS network reach to the file system and enabling data access when combined with ClientMount/ClientWrite permissions.

Raw rule rules/explicit/aws-efs.yaml

id: aws-efs-can-create-mount-target
emits: CanNetworkReach
description: A principal with elasticfilesystem:CreateMountTarget can place a new mount target in a subnet
  they control, gaining network access to the EFS file system.
match:
- - principal: null
  - HasPermission
  - filesystem: null
where:
- node_type(?filesystem) == FileStorage
- ?filesystem.provider_type == 'AWS::EFS::FileSystem'
- ?principal has EFFECTIVE elasticfilesystem:CreateMountTarget on ?filesystem
emit:
  source_type: Identity
  target_type: FileStorage
  source: ?principal
  target: ?filesystem
  permissions:
  - elasticfilesystem:CreateMountTarget
  conditions:
  - iam_permission
  - scp_or_org_policy
  - permission_boundary
  state_logic: "ACTIVE \u2014 the principal can immediately create a new mount target in a subnet of their\
    \ choice (typically one they control or have network access to). This enables them to reach the EFS\
    \ file system on port 2049 from their network. CONDITIONAL if the principal must obtain network access\
    \ to the EFS VPC first (e.g., via VPC peering). BLOCKED if an SCP or permission boundary denies elasticfilesystem:CreateMountTarget."
  confidence: 0.9
  derived_from:
  - <effective permission evaluation>
  false_positive_note: 'CreateMountTarget is a high-value network escalation primitive. A principal with
    both PutFileSystemPolicy and CreateMountTarget can achieve full file system data access with no network
    constraints: they rewrite the policy to grant ClientMount, then create a mount target in a network
    they control. This combination (PutFileSystemPolicy + CreateMountTarget) converts all CONDITIONAL
    CanReadData edges to ACTIVE regardless of the original mount target network configuration. CreateMountTarget
    alone does not grant data access without also having ClientMount/ClientWrite permissions.'
  narrative: '{principal.name} holds elasticfilesystem:CreateMountTarget on {filesystem.name} and can
    create a new mount target in a subnet they control, gaining NFS network reach to the file system and
    enabling data access when combined with ClientMount/ClientWrite permissions.'