aws-efs-client-mount-read-data

id: aws-efs-client-mount-read-data
emits: CanReadData
description: A principal with elasticfilesystem:ClientMount in the EFS file system policy can mount the
  file system and read all file data via NFS.
match:
- - principal: null
  - HasPermission
  - filesystem: null
where:
- node_type(?filesystem) == FileStorage
- ?filesystem.provider_type == 'AWS::EFS::FileSystem'
- "?principal has EFFECTIVE elasticfilesystem:ClientMount on ?filesystem (via identity policy OR file\
  \ system resource policy \u2014 EFS uses allow-in-either logic)"
- a reachable mount target exists in a VPC/subnet accessible to ?principal (NFS port 2049)
emit:
- source_type: Identity
  target_type: FileStorage
  source: ?principal
  target: ?filesystem
  permissions:
  - elasticfilesystem:ClientMount
  conditions:
  - iam_permission
  - resource_policy
  - network_reachability
  state_logic: "if network_reachability(?principal, ?filesystem mount target, port 2049) is confirmed:\
    \ ACTIVE; else CONDITIONAL(network_reachability). BLOCKED if an explicit Deny in the file system policy\
    \ or an SCP/permission boundary denies elasticfilesystem:ClientMount for this principal. Note: EFS\
    \ data encryption is transparent server-side (kms:ViaService); the caller does NOT need kms:Decrypt\
    \ \u2014 do not add key_permission to the gate. If the file system policy enforces aws:SecureTransport\
    \ (TLS), the caller must use the EFS mount helper with TLS; without the helper the mount fails \u2014\
    \ model as CONDITIONAL(network_reachability) with a tls_required annotation if enforced."
  confidence: 0.95
  derived_from:
  - <HasPermission(ClientMount) edge_id>
  - <mount_target_reachability>
  false_positive_note: "ClientMount alone is NFS read access to the ENTIRE file system (all directories,\
    \ files, metadata) unless the mount uses an access point that enforces a chroot root directory. When\
    \ the effective grant is through a file system policy `Principal: \"*\"` (anonymous), every same-account\
    \ IAM principal qualifies \u2014 but NFS reachability (port 2049 from the client to the mount target\
    \ ENI) is still mandatory. Do not emit ACTIVE for a cross-account principal whose VPC is not peered/connected\
    \ to the EFS VPC. Also: using the EFS mount helper without \"-o iam\" skips IAM enforcement entirely;\
    \ the rule models the IAM-authorized path. Without the mount helper, any principal that can reach\
    \ port 2049 can mount if the POSIX permissions allow \u2014 that is a separate, network-only path\
    \ not modeled here."
  narrative: '{principal.name} holds elasticfilesystem:ClientMount on {filesystem.name} and can reach
    its VPC mount target (NFS port 2049); mounting the file system grants read access to all files and
    metadata stored on it.'
- source_type: Compute
  target_type: FileStorage
  source: ?principal
  target: ?filesystem
  permissions:
  - elasticfilesystem:ClientMount
  conditions:
  - iam_permission
  - resource_policy
  - network_reachability
  state_logic: 'if network_reachability(?principal, ?filesystem mount target, port 2049) is confirmed:
    ACTIVE; else CONDITIONAL(network_reachability). Compute workloads (EC2, ECS, Lambda, etc.) with ClientMount
    permission can mount and read all file data via NFS. BLOCKED if an explicit Deny in the file system
    policy or an SCP/permission boundary denies elasticfilesystem:ClientMount.'
  confidence: 0.95
  derived_from:
  - <HasPermission(ClientMount) edge_id>
  - <mount_target_reachability>
  false_positive_note: 'This variant models the most common real-world EFS access pattern: Compute workloads
    (EC2 instance profiles, ECS task roles, Lambda execution roles, etc.) that mount and read from shared
    EFS volumes. The same caveats apply: network reachability to port 2049 is mandatory, and using the
    EFS mount helper without "-o iam" bypasses IAM enforcement.'
  narrative: '{principal.name} (Compute workload) holds elasticfilesystem:ClientMount on {filesystem.name}
    and can reach its VPC mount target (NFS port 2049); the workload can mount and read all files and
    metadata stored on it.'