aws-efs-default-policy-exposed-to-account

An EFS file system with no explicit file system policy (PolicyNotFound) is fully accessible to any same-account IAM principal that can network-reach the mount target.

derived aws emits ExposedToAccount

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

NOT EXISTS [ ?filesystem, HasPolicy, ?any_policy ]

where

node_type(?filesystem) == FileStorage ?filesystem.provider_type == 'AWS::EFS::FileSystem' ?filesystem.policy_status == 'PolicyNotFound' OR DescribeFileSystemPolicy returns PolicyNotFound for ?filesystem

emit

source type	`FileStorage`
target type	`Account`
source	`?filesystem`
target	`<AWS account that owns ?filesystem>`
permissions	`elasticfilesystem:ClientMount` `elasticfilesystem:ClientWrite` `elasticfilesystem:ClientRootAccess`
conditions	`network_reachability`
state logic	ACTIVE when mount is performed WITHOUT the EFS mount helper (no IAM enforcement). CONDITIONAL(iam_permission, network_reachability) when mount helper with "-o iam" is used — in that case the default policy is evaluated but IAM identity policy must also allow ClientMount. The default EFS policy grants all three client actions (ClientMount, ClientWrite, ClientRootAccess) at the NFS protocol level; however, when the mount helper is used with "-o iam", the IAM permission evaluator is invoked, making it CONDITIONAL on identity policy rather than ACTIVE. This rule models the STRUCTURAL misconfiguration (absence of an explicit policy), and the effective attack path depends on the mount method used. BLOCKED if an SCP enforces elasticfilesystem:ClientMount only for specific principals.

Narrative

{filesystem.name} has no explicit file system policy (PolicyNotFound); AWS applies the default policy granting ClientMount, ClientWrite, and ClientRootAccess to all same-account IAM principals that can reach the mount target - any workload in the account's VPC can mount and fully access this file system without any IAM check.

Raw rule rules/derived/aws/efs.yaml

id: aws-efs-default-policy-exposed-to-account
emits: ExposedToAccount
description: An EFS file system with no explicit file system policy (PolicyNotFound) is fully accessible
  to any same-account IAM principal that can network-reach the mount target.
match:
- NOT EXISTS [ ?filesystem, HasPolicy, ?any_policy ]
where:
- node_type(?filesystem) == FileStorage
- ?filesystem.provider_type == 'AWS::EFS::FileSystem'
- ?filesystem.policy_status == 'PolicyNotFound' OR DescribeFileSystemPolicy returns PolicyNotFound for
  ?filesystem
emit:
  source_type: FileStorage
  target_type: Account
  source: ?filesystem
  target: <AWS account that owns ?filesystem>
  permissions:
  - elasticfilesystem:ClientMount
  - elasticfilesystem:ClientWrite
  - elasticfilesystem:ClientRootAccess
  conditions:
  - network_reachability
  state_logic: "ACTIVE when mount is performed WITHOUT the EFS mount helper (no IAM enforcement). CONDITIONAL(iam_permission,\
    \ network_reachability) when mount helper with \"-o iam\" is used \u2014 in that case the default\
    \ policy is evaluated but IAM identity policy must also allow ClientMount. The default EFS policy\
    \ grants all three client actions (ClientMount, ClientWrite, ClientRootAccess) at the NFS protocol\
    \ level; however, when the mount helper is used with \"-o iam\", the IAM permission evaluator is invoked,\
    \ making it CONDITIONAL on identity policy rather than ACTIVE. This rule models the STRUCTURAL misconfiguration\
    \ (absence of an explicit policy), and the effective attack path depends on the mount method used.\
    \ BLOCKED if an SCP enforces elasticfilesystem:ClientMount only for specific principals."
  confidence: 0.9
  derived_from:
  - <PolicyNotFound observation on ?filesystem>
  false_positive_note: "The default policy does NOT make the file system reachable from the internet;\
    \ EFS has no public endpoint. Internet exposure requires additionally: (a) a mount target ENI in a\
    \ public subnet, (b) a security group allowing inbound NFS (2049) from 0.0.0.0/0, and (c) an NFS client\
    \ that can reach a public IP. That scenario (ExposedToInternet) would need an independent network\
    \ analysis rule. This rule emits ExposedToAccount \u2014 the blast radius is same-account \u2014 NOT\
    \ ExposedToInternet. Replication destination file systems that are locked for user writes should set\
    \ state to CONDITIONAL for CanWriteData derivations."
  narrative: "{filesystem.name} has no explicit file system policy (PolicyNotFound); AWS applies the default\
    \ policy granting ClientMount, ClientWrite, and ClientRootAccess to all same-account IAM principals\
    \ that can reach the mount target \u2014 any workload in the account's VPC can mount and fully access\
    \ this file system without any IAM check."