aws-emr-can-read-s3-data

An EMR cluster whose instance profile has s3:GetObject on a data lake bucket can read all objects in that bucket.

derived aws emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Storage`
source	`?role`
target	`<S3 bucket / ObjectStorage accessible by ?role>`
permissions	`s3:GetObject`
conditions	`iam_permission` `resource_policy`
state logic	ACTIVE when ?role has EFFECTIVE s3:GetObject on the target bucket (accounting for bucket policy, IAM policy, S3 Block Public Access, and any KMS key on the bucket). CONDITIONAL(key_permission) when the bucket is encrypted with a CMEK the role cannot decrypt. BLOCKED if an explicit SCP/deny prevents s3:GetObject.

source type

Identity

target type

Storage

source

?role

target

<S3 bucket / ObjectStorage accessible by ?role>

permissions

s3:GetObject

conditions

iam_permission resource_policy

state logic

ACTIVE when ?role has EFFECTIVE s3:GetObject on the target bucket (accounting for bucket policy, IAM policy, S3 Block Public Access, and any KMS key on the bucket). CONDITIONAL(key_permission) when the bucket is encrypted with a CMEK the role cannot decrypt. BLOCKED if an explicit SCP/deny prevents s3:GetObject.

Narrative

EMR cluster {cluster.name} (via instance profile {role.name}) can read data from S3 bucket {bucket.name} (s3:GetObject); Spark/Hive/Presto queries against this cluster can access all data in that bucket.

Raw rule rules/derived/aws/emr.yaml

id: aws-emr-can-read-s3-data
emits: CanReadData
description: An EMR cluster whose instance profile has s3:GetObject on a data lake bucket can read all
  objects in that bucket.
match:
- - cluster: null
  - ExecutesAs
  - role: null
where:
- node_type(?cluster) == AnalyticsService
- ?cluster provider_type == AWS::EMR::Cluster
- ?role has EFFECTIVE s3:GetObject on one or more ObjectStorage (S3 bucket) nodes
emit:
  source_type: Identity
  target_type: Storage
  source: ?role
  target: <S3 bucket / ObjectStorage accessible by ?role>
  permissions:
  - s3:GetObject
  conditions:
  - iam_permission
  - resource_policy
  state_logic: ACTIVE when ?role has EFFECTIVE s3:GetObject on the target bucket (accounting for bucket
    policy, IAM policy, S3 Block Public Access, and any KMS key on the bucket). CONDITIONAL(key_permission)
    when the bucket is encrypted with a CMEK the role cannot decrypt. BLOCKED if an explicit SCP/deny
    prevents s3:GetObject.
  derived_from:
  - <ExecutesAs(aws-emr-executes-as-instance-profile) edge_id>
  - <HasPermission(?role -> s3:GetObject) edge_id>
  false_positive_note: Only emit when the effective permission evaluation (accounting for bucket policy,
    SCP, permission boundary) confirms s3:GetObject on the specific bucket. Do not emit for all S3 buckets
    in the account without policy evidence. S3 Block Public Access and bucket ACLs may restrict access
    even when the IAM role policy allows it. Scope the target ObjectStorage node to the specific bucket
    ARN in scope for ?role's effective permissions.
  narrative: EMR cluster {cluster.name} (via instance profile {role.name}) can read data from S3 bucket
    {bucket.name} (s3:GetObject); Spark/Hive/Presto queries against this cluster can access all data in
    that bucket.