aws-efs-client-write-data

id: aws-efs-client-write-data
emits: CanWriteData
description: A principal with elasticfilesystem:ClientWrite in the EFS file system policy can mount the
  file system and write data via NFS.
match:
- - principal: null
  - HasPermission
  - filesystem: null
where:
- node_type(?filesystem) == FileStorage
- ?filesystem.provider_type == 'AWS::EFS::FileSystem'
- ?principal has EFFECTIVE elasticfilesystem:ClientWrite on ?filesystem (via identity policy OR file system
  resource policy)
- a reachable mount target exists in a VPC/subnet accessible to ?principal (NFS port 2049)
emit:
- source_type: Identity
  target_type: FileStorage
  source: ?principal
  target: ?filesystem
  permissions:
  - elasticfilesystem:ClientWrite
  conditions:
  - iam_permission
  - resource_policy
  - network_reachability
  state_logic: 'if network_reachability(?principal, ?filesystem mount target, port 2049) is confirmed:
    ACTIVE; else CONDITIONAL(network_reachability). BLOCKED if an explicit Deny in the file system policy
    or an SCP/permission boundary denies elasticfilesystem:ClientWrite for this principal. For replication
    destination file systems locked to read-only, upgrade to CONDITIONAL or BLOCKED despite the policy
    grant (the EFS service enforces write-lock).'
  confidence: 0.95
  derived_from:
  - <HasPermission(ClientWrite) edge_id>
  - <mount_target_reachability>
  false_positive_note: ClientWrite on a shared EFS volume grants write capability across all files and
    directories (unless the mount uses an access point that enforces a chroot + POSIX user enforcement).
    A principal with ClientWrite can overwrite existing files, create new files, or plant executable content
    to be picked up by workloads running as privileged roles. This is a high-value lateral movement vector
    when combined with workloads that mount the same EFS (model via credential-chains for credential files,
    or standalone for configuration/executable injection). Do not emit ACTIVE for a cross-account principal
    whose VPC is not peered/connected to the EFS VPC.
  narrative: '{principal.name} holds elasticfilesystem:ClientWrite on {filesystem.name} and can reach
    its VPC mount target (NFS port 2049); mounting the file system grants write access to all files and
    can plant malicious content for workloads that mount and execute files on the same EFS.'
- source_type: Compute
  target_type: FileStorage
  source: ?principal
  target: ?filesystem
  permissions:
  - elasticfilesystem:ClientWrite
  conditions:
  - iam_permission
  - resource_policy
  - network_reachability
  state_logic: 'if network_reachability(?principal, ?filesystem mount target, port 2049) is confirmed:
    ACTIVE; else CONDITIONAL(network_reachability). Compute workloads with ClientWrite can mount and write
    all file data via NFS, enabling lateral movement through shared EFS volumes. BLOCKED if an explicit
    Deny in the file system policy or an SCP/permission boundary denies elasticfilesystem:ClientWrite.'
  confidence: 0.95
  derived_from:
  - <HasPermission(ClientWrite) edge_id>
  - <mount_target_reachability>
  false_positive_note: 'This variant models Compute workloads (EC2, ECS, Lambda) with ClientWrite permission
    on shared EFS volumes. This is a high-value lateral movement path: the workload can write malicious
    files/configuration that other workloads mounting the same EFS will execute or depend on.'
  narrative: '{principal.name} (Compute workload) holds elasticfilesystem:ClientWrite on {filesystem.name}
    and can reach its VPC mount target (NFS port 2049); the workload can mount and write to all files
    on the EFS, enabling lateral movement to other workloads sharing the volume.'