aws-efs-can-modify-mount-target-sg

A principal with elasticfilesystem:ModifyMountTargetSecurityGroups can alter security group rules controlling NFS access to mount targets.

explicit aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Network`
source	`?principal`
target	`?mounttarget`
permissions	`elasticfilesystem:ModifyMountTargetSecurityGroups`
conditions	`iam_permission` `scp_or_org_policy` `permission_boundary`
state logic	ACTIVE — the principal can immediately modify the security group. BLOCKED if an SCP or permission boundary denies the action.

source type

Identity

target type

Network

source

?principal

target

?mounttarget

permissions

elasticfilesystem:ModifyMountTargetSecurityGroups

conditions

iam_permission scp_or_org_policy permission_boundary

state logic

ACTIVE — the principal can immediately modify the security group. BLOCKED if an SCP or permission boundary denies the action.

Narrative

{principal.name} holds elasticfilesystem:ModifyMountTargetSecurityGroups and can alter the security group rules on mount targets, enabling or restricting NFS access from different networks.

Raw rule rules/explicit/aws-efs.yaml

id: aws-efs-can-modify-mount-target-sg
emits: CanModifyConfiguration
description: A principal with elasticfilesystem:ModifyMountTargetSecurityGroups can alter security group
  rules controlling NFS access to mount targets.
match:
- - principal: null
  - HasPermission
  - mounttarget: null
where:
- node_type(?mounttarget) == Network
- ?mounttarget.provider_type == 'AWS::EFS::MountTarget'
- ?principal has EFFECTIVE elasticfilesystem:ModifyMountTargetSecurityGroups on the FileSystem containing
  ?mounttarget
emit:
  source_type: Identity
  target_type: Network
  source: ?principal
  target: ?mounttarget
  permissions:
  - elasticfilesystem:ModifyMountTargetSecurityGroups
  conditions:
  - iam_permission
  - scp_or_org_policy
  - permission_boundary
  state_logic: "ACTIVE \u2014 the principal can immediately modify the security group. BLOCKED if an SCP\
    \ or permission boundary denies the action."
  confidence: 0.95
  derived_from:
  - <effective permission evaluation>
  false_positive_note: This permission modifies network configuration (security group rules), not the
    file system's IAM resource policy. It enables opening NFS port 2049 inbound from arbitrary CIDR blocks,
    converting CONDITIONAL edges that depend on network_reachability to ACTIVE.
  narrative: '{principal.name} holds elasticfilesystem:ModifyMountTargetSecurityGroups and can alter the
    security group rules on mount targets, enabling or restricting NFS access from different networks.'