aws-efs-modifymounttarget-sg-network-escalation
A principal with elasticfilesystem:ModifyMountTargetSecurityGroups can modify mount target security groups to enable NFS access, converting conditional data-access edges to active.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?mounttarget) == Network
?mounttarget.provider_type == 'AWS::EFS::MountTarget'
?mounttarget is attached to a FileSystem (?filesystem)
node_type(?filesystem) ==
FileStorage
?filesystem.provider_type == 'AWS::EFS::FileSystem'
emit
| source type | Identity |
|---|---|
| target type | Network |
| source | ?principal |
| target | ?mounttarget |
| permissions | elasticfilesystem:ModifyMountTargetSecurityGroups |
| conditions | iam_permission network_reachability |
| state logic | ACTIVE — the principal can modify the mount target's security group to allow NFS traffic (port 2049 TCP/UDP) from their own network CIDR. This capability upgrades any CONDITIONAL(network_reachability) CanReadData or CanWriteData edge on the associated file system to ACTIVE, provided the principal also holds the client-action permission (ClientMount, ClientWrite, etc.) in the file system policy or a connected identity policy. BLOCKED if an SCP or permission boundary denies the ModifyMountTargetSecurityGroups action. |
Narrative
{principal.name} can modify the security group on mount targets of {filesystem.name} to enable inbound NFS traffic (port 2049), converting network-conditional data access to active reachability.
Raw rule rules/derived/aws/efs.yaml
id: aws-efs-modifymounttarget-sg-network-escalation
emits: CanNetworkReach
description: A principal with elasticfilesystem:ModifyMountTargetSecurityGroups can modify mount target
security groups to enable NFS access, converting conditional data-access edges to active.
match:
- - principal: null
- CanModifyConfiguration
- mounttarget: null
where:
- node_type(?mounttarget) == Network
- ?mounttarget.provider_type == 'AWS::EFS::MountTarget'
- ?mounttarget is attached to a FileSystem (?filesystem)
- node_type(?filesystem) == FileStorage
- ?filesystem.provider_type == 'AWS::EFS::FileSystem'
emit:
source_type: Identity
target_type: Network
source: ?principal
target: ?mounttarget
permissions:
- elasticfilesystem:ModifyMountTargetSecurityGroups
conditions:
- iam_permission
- network_reachability
state_logic: "ACTIVE \u2014 the principal can modify the mount target's security group to allow NFS\
\ traffic (port 2049 TCP/UDP) from their own network CIDR. This capability upgrades any CONDITIONAL(network_reachability)\
\ CanReadData or CanWriteData edge on the associated file system to ACTIVE, provided the principal\
\ also holds the client-action permission (ClientMount, ClientWrite, etc.) in the file system policy\
\ or a connected identity policy. BLOCKED if an SCP or permission boundary denies the ModifyMountTargetSecurityGroups\
\ action."
confidence: 0.9
derived_from:
- <CanModifyConfiguration(ModifyMountTargetSecurityGroups) edge_id>
- <mount_target_to_filesystem attachment>
false_positive_note: 'This permission allows MODIFYING network access (opening port 2049), not directly
reading/writing data. The full escalation chain is: (1) principal has ClientMount CONDITIONAL on network
reach, (2) principal has ModifyMountTargetSecurityGroups, (3) principal modifies the SG to allow inbound
2049 from their network, (4) CanReadData becomes ACTIVE. This is a two-step escalation that requires
both the network permission AND the existing client-action grant. Do not emit for a principal that
lacks the underlying ClientMount/ClientWrite permission.'
narrative: '{principal.name} can modify the security group on mount targets of {filesystem.name} to
enable inbound NFS traffic (port 2049), converting network-conditional data access to active reachability.'