aws-fsx-backup-resource-policy-cross-trust

id: aws-fsx-backup-resource-policy-cross-trust
emits: CrossAccountTrust
description: A backup's resource policy (via fsx:GetResourcePolicy) grants fsx:CopyBackup to a principal
  in a different AWS account, establishing a cross-account trust on the backup resource.
match:
- - backup: null
  - HasPolicy
  - resource_policy: null
- - backup: null
  - LocatedIn
  - account: null
where:
- node_type(?backup) == Backup
- ?backup.provider_type == 'AWS::FSx::Backup'
- node_type(?resource_policy) == ResourcePolicy
- 'collector evidence: fsx:GetResourcePolicy(?backup) response includes a Statement with Principal from
  external account'
- the Statement grants fsx:CopyBackup or fsx:* to the external account
- '?external_account != ?account  # different account'
emit:
  source_type: ResourcePolicy
  target_type: ExternalIdentity
  source: ?resource_policy
  target: <ExternalAccount principal from resource policy>
  permissions: []
  conditions: []
  state_logic: 'ACTIVE if fsx:GetResourcePolicy response is confirmed to include a Statement granting
    fsx:CopyBackup (or fsx:*) to a principal in a different account. This is a direct data fact, not a
    per-principal derivation. Downstream, this edge feeds aws-fsx-backup-cross-account-exfil: a principal
    in the external account holding fsx:CopyBackup can use this CrossAccountTrust to justify the CanExfiltrate
    edge.'
  confidence: 0.95
  derived_from: []
  false_positive_note: Only emit when fsx:GetResourcePolicy explicitly returns a Statement granting access
    to a principal in a different account. Verify the account number is truly external (not same account).
    Do not emit if the policy grants only s3:GetObject or other non-FSx permissions.
  narrative: '{backup.name} (FSx Backup) has a resource policy granting fsx:CopyBackup to a principal
    in account {external_account.name}. This establishes a cross-account trust on the backup, enabling
    the external account to pull a copy of the backup via fsx:CopyBackup.'