aws-efs-put-fs-policy-grants-write-access

id: aws-efs-put-fs-policy-grants-write-access
emits: CanWriteData
description: A principal with elasticfilesystem:PutFileSystemPolicy can self-grant ClientWrite and write
  all file data on the EFS file system.
match:
- - principal: null
  - CanModifyPolicy
  - fspolicy: null
where:
- ?fspolicy is a ResourcePolicy on a FileStorage node (?filesystem)
- node_type(?filesystem) == FileStorage
- ?filesystem.provider_type == 'AWS::EFS::FileSystem'
- ?principal has EFFECTIVE elasticfilesystem:PutFileSystemPolicy on ?filesystem
emit:
- source_type: Identity
  target_type: FileStorage
  source: ?principal
  target: ?filesystem
  permissions:
  - elasticfilesystem:PutFileSystemPolicy
  conditions:
  - iam_permission
  - network_reachability
  state_logic: "CONDITIONAL(network_reachability) \u2014 PutFileSystemPolicy alone grants the ABILITY\
    \ to self-grant ClientWrite; the actual data write requires a subsequent NFS mount via a network-reachable\
    \ mount target (port 2049). If network reachability is confirmed: upgrade to ACTIVE. BLOCKED if an\
    \ SCP or permission boundary denies elasticfilesystem:PutFileSystemPolicy."
  confidence: 0.85
  derived_from:
  - <CanModifyPolicy(PutFileSystemPolicy) edge_id>
  false_positive_note: "PutFileSystemPolicy is a two-step escalation: (1) rewrite the policy to include\
    \ ClientWrite, (2) mount via NFS with write capability. Step 2 requires network reach to the mount\
    \ target. A principal with PutFileSystemPolicy but no VPC connectivity has the CONTROL-PLANE capability\
    \ but not immediate write access \u2014 set CONDITIONAL(network_reachability). This is a lateral movement\
    \ amplifier: the attacker can write malicious files on a shared EFS volume picked up by other workloads,\
    \ or corrupt existing data."
  narrative: '{principal.name} can rewrite the file system policy of {filesystem.name} (elasticfilesystem:PutFileSystemPolicy)
    to self-grant elasticfilesystem:ClientWrite, then mount the file system via NFS and write/corrupt
    all files and metadata.'
- source_type: Compute
  target_type: FileStorage
  source: ?principal
  target: ?filesystem
  permissions:
  - elasticfilesystem:PutFileSystemPolicy
  conditions:
  - iam_permission
  - network_reachability
  state_logic: 'CONDITIONAL(network_reachability) for Compute workloads with PutFileSystemPolicy. The
    workload can rewrite the file system policy to self-grant ClientWrite, then mount and write all data
    via NFS. If the workload is in the same VPC: upgrade to ACTIVE. BLOCKED if an SCP or permission boundary
    denies elasticfilesystem:PutFileSystemPolicy.'
  confidence: 0.85
  derived_from:
  - <CanModifyPolicy(PutFileSystemPolicy) edge_id>
  false_positive_note: This variant models Compute workloads with PutFileSystemPolicy. The workload can
    rewrite the policy to grant ClientWrite and immediately write to the EFS volume if network-reachable,
    enabling lateral movement through shared EFS.
  narrative: '{principal.name} (Compute workload) can rewrite the file system policy of {filesystem.name}
    to self-grant ClientWrite and write/corrupt all file data on the EFS volume.'