aws-emr-studio-workspace-s3-url
S3 URI backing EMR Studio workspace (DefaultS3Location); used to detect notebook-injection attack surface.
match (record)
{
"field": "Studio.DefaultS3Location",
"resource_type": "AWS::EMR::Studio"
}
where
DefaultS3Location is non-empty
emit
| source type | Data |
|---|---|
| target type | Storage |
| source | <EMR Studio (AnalyticsService)> |
| target | <S3 object path at DefaultS3Location> |
Narrative
EMR Studio {studio.name} stores notebooks and workspace data in S3 path {s3_location}. Anyone who can write to this S3 location can inject arbitrary code into notebooks, which run as the cluster's JobFlowRole or the Studio service role.
Raw rule rules/explicit/aws-emr.yaml
id: aws-emr-studio-workspace-s3-url
emits: ContainsResourceReference
description: S3 URI backing EMR Studio workspace (DefaultS3Location); used to detect notebook-injection
attack surface.
match_record:
resource_type: AWS::EMR::Studio
field: Studio.DefaultS3Location
where:
- DefaultS3Location is non-empty
emit:
source_type: Data
target_type: Storage
source: <EMR Studio (AnalyticsService)>
target: <S3 object path at DefaultS3Location>
api_source: elasticmapreduce:DescribeStudio
evidence_field: Studio.DefaultS3Location
state: ACTIVE
narrative: EMR Studio {studio.name} stores notebooks and workspace data in S3 path {s3_location}. Anyone
who can write to this S3 location can inject arbitrary code into notebooks, which run as the cluster's
JobFlowRole or the Studio service role.