aws-efs-client-root-access-posix-bypass

id: aws-efs-client-root-access-posix-bypass
emits: CanReadData
description: A principal with elasticfilesystem:ClientRootAccess can bypass POSIX root-squash and read
  all file data including root-owned files.
match:
- - principal: null
  - HasPermission
  - filesystem: null
where:
- node_type(?filesystem) == FileStorage
- ?filesystem.provider_type == 'AWS::EFS::FileSystem'
- ?principal has EFFECTIVE elasticfilesystem:ClientRootAccess on ?filesystem
- ?principal also has EFFECTIVE (elasticfilesystem:ClientMount OR elasticfilesystem:ClientWrite) on ?filesystem
- a reachable mount target exists in a VPC/subnet accessible to ?principal (NFS port 2049)
emit:
- source_type: Identity
  target_type: FileStorage
  source: ?principal
  target: ?filesystem
  permissions:
  - elasticfilesystem:ClientRootAccess
  - elasticfilesystem:ClientMount
  conditions:
  - iam_permission
  - resource_policy
  - network_reachability
  state_logic: 'ACTIVE when both ClientRootAccess and ClientMount (or ClientWrite) are granted and network
    reachability is confirmed. Indicates POSIX root-squash bypass: the principal can mount the file system
    as UID 0 and access all files regardless of POSIX mode bits. This is distinct from the regular ClientMount
    edge (which assumes POSIX enforcement). CONDITIONAL if network reachability is unconfirmed.'
  confidence: 0.98
  derived_from:
  - <HasPermission(ClientRootAccess) + ClientMount edges>
  false_positive_note: ClientRootAccess is a privileged mount mode that requires BOTH the ClientRootAccess
    AND one of ClientMount/ClientWrite in the same principal's effective grant. Do not emit if only ClientRootAccess
    is granted without a mount action. This rule emits with high confidence (0.98) to surface the POSIX-bypass
    consequence distinctly from regular ClientMount.
  narrative: '{principal.name} holds elasticfilesystem:ClientRootAccess on {filesystem.name} and can bypass
    POSIX root-squash, mounting the file system as UID 0 and reading all files including those owned by
    root.'
- source_type: Compute
  target_type: FileStorage
  source: ?principal
  target: ?filesystem
  permissions:
  - elasticfilesystem:ClientRootAccess
  - elasticfilesystem:ClientMount
  conditions:
  - iam_permission
  - resource_policy
  - network_reachability
  state_logic: ACTIVE when Compute workload has both ClientRootAccess and ClientMount/ClientWrite and
    network reachability is confirmed. The workload can mount as UID 0 and access all files, enabling
    reading of root-owned secrets, configuration, and metadata.
  confidence: 0.98
  derived_from:
  - <HasPermission(ClientRootAccess) + ClientMount edges>
  false_positive_note: Compute workloads with ClientRootAccess (EC2 instances, ECS tasks, Lambda functions)
    can access sensitive root-owned files on shared EFS volumes, defeating standard POSIX permission protections.
  narrative: '{principal.name} (Compute workload) holds elasticfilesystem:ClientRootAccess on {filesystem.name}
    and can bypass POSIX root-squash, accessing all files including root-owned secrets and configuration.'