aws-efs-put-fs-policy-grants-data-access

id: aws-efs-put-fs-policy-grants-data-access
emits: CanReadData
description: A principal with elasticfilesystem:PutFileSystemPolicy can self-grant ClientMount and read
  all file data on the EFS file system.
match:
- - principal: null
  - CanModifyPolicy
  - fspolicy: null
where:
- ?fspolicy is a ResourcePolicy on a FileStorage node (?filesystem)
- node_type(?filesystem) == FileStorage
- ?filesystem.provider_type == 'AWS::EFS::FileSystem'
- ?principal has EFFECTIVE elasticfilesystem:PutFileSystemPolicy on ?filesystem
emit:
- source_type: Identity
  target_type: FileStorage
  source: ?principal
  target: ?filesystem
  permissions:
  - elasticfilesystem:PutFileSystemPolicy
  conditions:
  - iam_permission
  - network_reachability
  state_logic: "CONDITIONAL(network_reachability) \u2014 PutFileSystemPolicy alone grants the ABILITY\
    \ to self-grant ClientMount; the actual data read requires a subsequent NFS mount via a network-reachable\
    \ mount target (port 2049). If network reachability is confirmed (principal is a workload in the same\
    \ VPC as the mount target): upgrade to ACTIVE. BLOCKED if an SCP or permission boundary denies elasticfilesystem:PutFileSystemPolicy\
    \ (the self-grant action itself is blocked)."
  confidence: 0.85
  derived_from:
  - <CanModifyPolicy(PutFileSystemPolicy) edge_id>
  false_positive_note: "PutFileSystemPolicy is a two-step escalation: (1) rewrite the policy, (2) mount\
    \ via NFS. Step 2 requires network reach to the mount target. A principal with PutFileSystemPolicy\
    \ but no VPC connectivity to any mount target has the CONTROL-PLANE capability but not immediate data\
    \ access \u2014 set CONDITIONAL(network_reachability). Note that the attacker can also create a new\
    \ mount target (elasticfilesystem:CreateMountTarget) in their own VPC to gain network reach; this\
    \ is a POTENTIAL follow-on step, not modeled here. Do not emit CanWriteData from PutFileSystemPolicy\
    \ alone (write also needs ClientWrite in the new policy AND network reach); CanReadData is the conservative\
    \ floor capability from this self-grant."
  narrative: '{principal.name} can rewrite the file system policy of {filesystem.name} (elasticfilesystem:PutFileSystemPolicy)
    to self-grant elasticfilesystem:ClientMount, then mount the file system via NFS and read all stored
    files and metadata.'
- source_type: Compute
  target_type: FileStorage
  source: ?principal
  target: ?filesystem
  permissions:
  - elasticfilesystem:PutFileSystemPolicy
  conditions:
  - iam_permission
  - network_reachability
  state_logic: 'CONDITIONAL(network_reachability) for Compute workloads with PutFileSystemPolicy. The
    workload can rewrite the file system policy to self-grant ClientMount, then mount and read all data
    via NFS. If the workload is in the same VPC as the mount target or has existing network connectivity:
    upgrade to ACTIVE. BLOCKED if an SCP or permission boundary denies elasticfilesystem:PutFileSystemPolicy.'
  confidence: 0.85
  derived_from:
  - <CanModifyPolicy(PutFileSystemPolicy) edge_id>
  false_positive_note: This variant models Compute workloads (EC2, ECS, Lambda) with PutFileSystemPolicy.
    The workload can immediately rewrite the policy and mount if network-reachable, making this a high-value
    escalation when the workload is in the same VPC as the mount target.
  narrative: '{principal.name} (Compute workload) can rewrite the file system policy of {filesystem.name}
    (elasticfilesystem:PutFileSystemPolicy) to self-grant ClientMount and read all file data.'