aws-fsx-lustre-dra-exfil

An identity with fsx:CreateDataRepositoryTask on an FSx for Lustre file system with a Data Repository Association (DRA) pointing to an attacker-accessible S3 bucket can trigger a data export from the Lustre FS to S3, exfiltrating all file data.

derived aws emits CanExfiltrate

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'filesystem': None}

where

node_type(?filesystem) == FileStorage ?filesystem.provider_type == 'AWS::FSx::FileSystem' ?filesystem.properties.FileSystemType == 'Lustre' ?principal has EFFECTIVE fsx:CreateDataRepositoryTask on ?filesystem ?filesystem.properties.DataRepositoryAssociations exists and is non-empty (collector evidence: DescribeDataRepositoryAssociations response includes at least one DRA for this file system) at least one DRA in ?filesystem.properties.DataRepositoryAssociations has DataRepositoryPath starting with 's3://' (points to an S3 bucket)

emit

source type	`Identity`
target type	`FileStorage`
source	`?principal`
target	`?filesystem`
permissions	`fsx:CreateDataRepositoryTask`
conditions	`iam_permission` `trigger_exists`
state logic	ACTIVE if the identity policy grants fsx:CreateDataRepositoryTask on the Lustre FS ARN and the collector has confirmed that the FS has a DRA pointing to an S3 bucket (accessible to the attacker); CONDITIONAL(trigger_exists) if the fsx:CreateDataRepositoryTask permission is confirmed but the DRA configuration or S3 bucket access/ownership is not yet confirmed; POTENTIAL if fsx:CreateDataRepositoryTask is broadly granted but DRA existence on the FS is not confirmed by collector data.

Narrative

{principal.name} holds fsx:CreateDataRepositoryTask on {filesystem.name} (FSx for Lustre), which has a Data Repository Association linking to an S3 bucket. This allows the attacker to trigger fsx:CreateDataRepositoryTask to export data from the Lustre FS to S3, exfiltrating all file data.

Raw rule rules/derived/aws/fsx.yaml

id: aws-fsx-lustre-dra-exfil
emits: CanExfiltrate
description: An identity with fsx:CreateDataRepositoryTask on an FSx for Lustre file system with a Data
  Repository Association (DRA) pointing to an attacker-accessible S3 bucket can trigger a data export
  from the Lustre FS to S3, exfiltrating all file data.
match:
- - principal: null
  - HasPermission
  - filesystem: null
where:
- node_type(?filesystem) == FileStorage
- ?filesystem.provider_type == 'AWS::FSx::FileSystem'
- ?filesystem.properties.FileSystemType == 'Lustre'
- ?principal has EFFECTIVE fsx:CreateDataRepositoryTask on ?filesystem
- '?filesystem.properties.DataRepositoryAssociations exists and is non-empty (collector evidence: DescribeDataRepositoryAssociations
  response includes at least one DRA for this file system)'
- at least one DRA in ?filesystem.properties.DataRepositoryAssociations has DataRepositoryPath starting
  with 's3://' (points to an S3 bucket)
emit:
  source_type: Identity
  target_type: FileStorage
  source: ?principal
  target: ?filesystem
  permissions:
  - fsx:CreateDataRepositoryTask
  conditions:
  - iam_permission
  - trigger_exists
  state_logic: ACTIVE if the identity policy grants fsx:CreateDataRepositoryTask on the Lustre FS ARN
    and the collector has confirmed that the FS has a DRA pointing to an S3 bucket (accessible to the
    attacker); CONDITIONAL(trigger_exists) if the fsx:CreateDataRepositoryTask permission is confirmed
    but the DRA configuration or S3 bucket access/ownership is not yet confirmed; POTENTIAL if fsx:CreateDataRepositoryTask
    is broadly granted but DRA existence on the FS is not confirmed by collector data.
  confidence: 0.8
  derived_from:
  - ?principal HasPermission fsx:CreateDataRepositoryTask on ?filesystem
  false_positive_note: 'This rule requires confirmation of three preconditions: (1) the Lustre file system
    has an active DRA (confirmed by DescribeDataRepositoryAssociations collector evidence in ?filesystem.properties.DataRepositoryAssociations),
    (2) the DRA points to an S3 bucket (DataRepositoryPath starts with ''s3://''), (3) the attacker can
    read/write to that S3 bucket (requires separate S3 bucket permission check). If the S3 bucket is owned
    by a different account or has deny policies blocking the attacker, emit CONDITIONAL(trigger_exists)
    not ACTIVE. A Lustre FS without any DRA configured (empty or absent DataRepositoryAssociations property)
    cannot reach this path; emit POTENTIAL only.'
  narrative: '{principal.name} holds fsx:CreateDataRepositoryTask on {filesystem.name} (FSx for Lustre),
    which has a Data Repository Association linking to an S3 bucket. This allows the attacker to trigger
    fsx:CreateDataRepositoryTask to export data from the Lustre FS to S3, exfiltrating all file data.'