aws-efs-can-modify-policy

A principal with elasticfilesystem:PutFileSystemPolicy can rewrite the EFS file system resource policy.

explicit aws emits CanModifyPolicy

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Policy`
source	`?principal`
target	`<ResourcePolicy on ?filesystem>`
permissions	`elasticfilesystem:PutFileSystemPolicy`
conditions	`iam_permission` `scp_or_org_policy` `permission_boundary`
state logic	ACTIVE — the principal holds the permission and can immediately invoke PutFileSystemPolicy to rewrite the resource policy. BLOCKED if an SCP or permission boundary denies elasticfilesystem:PutFileSystemPolicy.

source type

Identity

target type

Policy

source

?principal

target

<ResourcePolicy on ?filesystem>

permissions

elasticfilesystem:PutFileSystemPolicy

conditions

iam_permission scp_or_org_policy permission_boundary

state logic

ACTIVE — the principal holds the permission and can immediately invoke PutFileSystemPolicy to rewrite the resource policy. BLOCKED if an SCP or permission boundary denies elasticfilesystem:PutFileSystemPolicy.

Narrative

{principal.name} holds elasticfilesystem:PutFileSystemPolicy on {filesystem.name} and can rewrite the file system's resource policy.

Raw rule rules/explicit/aws-efs.yaml

id: aws-efs-can-modify-policy
emits: CanModifyPolicy
description: A principal with elasticfilesystem:PutFileSystemPolicy can rewrite the EFS file system resource
  policy.
match:
- - principal: null
  - HasPermission
  - filesystem: null
where:
- node_type(?filesystem) == FileStorage
- ?filesystem.provider_type == 'AWS::EFS::FileSystem'
- ?principal has EFFECTIVE elasticfilesystem:PutFileSystemPolicy on ?filesystem
emit:
  source_type: Identity
  target_type: Policy
  source: ?principal
  target: <ResourcePolicy on ?filesystem>
  permissions:
  - elasticfilesystem:PutFileSystemPolicy
  conditions:
  - iam_permission
  - scp_or_org_policy
  - permission_boundary
  state_logic: "ACTIVE \u2014 the principal holds the permission and can immediately invoke PutFileSystemPolicy\
    \ to rewrite the resource policy. BLOCKED if an SCP or permission boundary denies elasticfilesystem:PutFileSystemPolicy."
  confidence: 0.95
  derived_from:
  - <effective permission evaluation on ?filesystem ARN>
  false_positive_note: This models the control-plane permission only. The actual data-plane access (CanReadData,
    CanWriteData) follows AFTER the principal rewrites the policy to self-grant ClientMount/ClientWrite,
    then mounts the file system. This is a two-step escalation modeled in derived rules.
  narrative: '{principal.name} holds elasticfilesystem:PutFileSystemPolicy on {filesystem.name} and can
    rewrite the file system''s resource policy.'