aws-fsx-backup-cross-account-exfil

An identity with fsx:CopyBackup on a source backup ARN in a foreign account can pull a complete copy into an attacker-controlled account; restoring via CreateFileSystemFromBackup gives full read of all data at backup time.

derived aws emits CanExfiltrate

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'backup': None}

where

node_type(?backup) == Backup ?backup.provider_type == 'AWS::FSx::Backup' ?principal.account != ?backup.account # cross-account: principal in a different account than the backup ?principal has EFFECTIVE fsx:CopyBackup on ?backup (identity policy resource scope covers the backup ARN, OR backup has a resource policy granting ?principal fsx:CopyBackup) EFFECTIVE resource scope includes the foreign-account backup ARN OR ?backup has CrossAccountTrust(Backup -> ?principal.account)

emit

source type	`Identity`
target type	`Backup`
source	`?principal`
target	`?backup`
permissions	`fsx:CopyBackup`
conditions	`iam_permission` `resource_policy`
state logic	ACTIVE if the identity policy resource scope explicitly includes the source backup ARN (foreign account) AND the permission is not denied by an SCP or permission boundary; CONDITIONAL(resource_policy) if only the backup resource policy confirms the cross-account grant but caller's identity policy does not explicitly include the foreign ARN; POTENTIAL if fsx:CopyBackup is broadly present but the foreign backup ARN scope is not confirmed reachable via either identity policy or resource policy. Restore via fsx:CreateFileSystemFromBackup is a subsequent action in the attacker's own account (not gated here).

Narrative

{principal.name} holds fsx:CopyBackup on {backup.name} (owned by a different account), enabling it to pull a full copy of the backup into its own account and restore it via fsx:CreateFileSystemFromBackup, obtaining complete read access to all data captured in the backup without touching the live file system.

Raw rule rules/derived/aws/fsx.yaml

id: aws-fsx-backup-cross-account-exfil
emits: CanExfiltrate
description: An identity with fsx:CopyBackup on a source backup ARN in a foreign account can pull a complete
  copy into an attacker-controlled account; restoring via CreateFileSystemFromBackup gives full read of
  all data at backup time.
match:
- - principal: null
  - HasPermission
  - backup: null
where:
- node_type(?backup) == Backup
- ?backup.provider_type == 'AWS::FSx::Backup'
- '?principal.account != ?backup.account  # cross-account: principal in a different account than the backup'
- ?principal has EFFECTIVE fsx:CopyBackup on ?backup (identity policy resource scope covers the backup
  ARN, OR backup has a resource policy granting ?principal fsx:CopyBackup)
- EFFECTIVE resource scope includes the foreign-account backup ARN OR ?backup has CrossAccountTrust(Backup
  -> ?principal.account)
emit:
  source_type: Identity
  target_type: Backup
  source: ?principal
  target: ?backup
  permissions:
  - fsx:CopyBackup
  conditions:
  - iam_permission
  - resource_policy
  state_logic: ACTIVE if the identity policy resource scope explicitly includes the source backup ARN
    (foreign account) AND the permission is not denied by an SCP or permission boundary; CONDITIONAL(resource_policy)
    if only the backup resource policy confirms the cross-account grant but caller's identity policy does
    not explicitly include the foreign ARN; POTENTIAL if fsx:CopyBackup is broadly present but the foreign
    backup ARN scope is not confirmed reachable via either identity policy or resource policy. Restore
    via fsx:CreateFileSystemFromBackup is a subsequent action in the attacker's own account (not gated
    here).
  confidence: 0.85
  derived_from:
  - ?principal HasPermission fsx:CopyBackup on ?backup
  false_positive_note: fsx:CopyBackup with Resource:* in the caller's identity policy covers only backups
    IN THE SAME ACCOUNT unless the source backup ARN from a foreign account is explicitly included. Confirm
    that the effective resource scope includes the foreign-account backup ARN or that the backup has CrossAccountTrust(Backup
    -> ?principal.account). Do not emit ACTIVE when only a same-account fsx:CopyBackup grant is present.
  narrative: '{principal.name} holds fsx:CopyBackup on {backup.name} (owned by a different account), enabling
    it to pull a full copy of the backup into its own account and restore it via fsx:CreateFileSystemFromBackup,
    obtaining complete read access to all data captured in the backup without touching the live file system.'