aws-efs-cross-account-fs-policy

id: aws-efs-cross-account-fs-policy
emits: CrossAccountTrust
description: An EFS file system policy granting ClientMount to a principal from another AWS account creates
  a cross-account NFS data path.
match:
- - filesystem: null
  - HasPolicy
  - fspolicy: null
where:
- node_type(?filesystem) == FileStorage
- ?filesystem.provider_type == 'AWS::EFS::FileSystem'
- node_type(?fspolicy) == ResourcePolicy
- ?fspolicy is attached to ?filesystem
- ?fspolicy.Statement contains a Principal from a different AWS account (?external_account)
- the Statement's Action includes at least elasticfilesystem:ClientMount or elasticfilesystem:Client*
- the Statement Effect is Allow
emit:
- source_type: ResourcePolicy
  target_type: Account
  source: ?fspolicy
  target: <external AWS account named in ?fspolicy>
  permissions:
  - elasticfilesystem:ClientMount
  conditions:
  - resource_policy
  - network_reachability
  state_logic: "ACTIVE \u2014 the resource policy explicitly grants the cross-account mount action to\
    \ the entire account; the trust fact exists regardless of whether network reachability is confirmed.\
    \ Set CONDITIONAL(network_reachability) if it is unknown whether the external account's VPC can reach\
    \ the mount target on NFS port 2049. BLOCKED if an SCP on either account denies the mount action or\
    \ the cross-account principal type. This variant applies when the Statement Principal is an account\
    \ ID or account root (arn:aws:iam::ACCOUNT:root)."
  confidence: 0.9
  derived_from:
  - <ResourcePolicy observation on ?filesystem>
  - <Principal cross-account in Statement>
  false_positive_note: "A cross-account ClientMount grant is a trust FACT regardless of whether the external\
    \ principal has identity-policy permissions (EFS uses allow-in-either: the resource policy allow is\
    \ sufficient). However, the external principal still needs NFS network reachability (VPC peering,\
    \ Transit Gateway, or DirectConnect); a cross-account mount without network reach is non-exploitable.\
    \ Honor Condition keys in the statement: `elasticfilesystem:AccessedViaMountTarget:true` is a common\
    \ hardening condition and does not block the trust (it enforces that the mount uses the official NFS\
    \ path). A condition on `elasticfilesystem:AccessPointArn` restricts access to a specific subdirectory\
    \ via the access point \u2014 the trust still exists but CanReadData is narrowed to that path. Do\
    \ NOT emit for Deny statements or for Principals scoped to the same account."
  narrative: "The file system policy on {filesystem.name} grants elasticfilesystem:ClientMount to account\
    \ {external_account} \u2014 any principal in that account with matching IAM identity and NFS network\
    \ reach to the mount target can mount and read the file system cross-account."
- source_type: ResourcePolicy
  target_type: ExternalIdentity
  source: ?fspolicy
  target: <specific IAM role/user named in ?fspolicy>
  permissions:
  - elasticfilesystem:ClientMount
  conditions:
  - resource_policy
  - network_reachability
  state_logic: "ACTIVE \u2014 the resource policy explicitly grants the cross-account mount action to\
    \ a specific foreign principal (role or user ARN). The trust fact exists regardless of whether network\
    \ reachability is confirmed. Set CONDITIONAL(network_reachability) if it is unknown whether the external\
    \ principal's VPC can reach the mount target on NFS port 2049. BLOCKED if an SCP on either account\
    \ denies the mount action. This variant applies when the Statement Principal is a specific IAM ARN\
    \ (role, user) rather than an account root."
  confidence: 0.9
  derived_from:
  - <ResourcePolicy observation on ?filesystem>
  - <specific Principal ARN in Statement>
  false_positive_note: 'A cross-account grant to a specific principal (rather than the entire account)
    reflects more targeted access control. The same caveats apply: NFS network reach is required, and
    downstream CanReadData edges are scoped to the specific named principal.'
  narrative: The file system policy on {filesystem.name} grants elasticfilesystem:ClientMount to a specific
    principal ({target}); that external principal with NFS network reach to the mount target can mount
    and read the file system cross-account.