aws-fsx-ontap-volume-restore-from-backup

An identity with fsx:CreateVolumeFromBackup on an ONTAP volume backup (same account) can restore the volume to an ONTAP file system they control, achieving lateral movement and data access to the restored volume.

derived aws emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'backup': None}

where

node_type(?backup) == Backup ?backup.provider_type == 'AWS::FSx::Backup' ?backup.properties.FileSystemType == 'ONTAP' # backup is from an ONTAP file system or volume ?principal.account == ?backup.account # same-account: not cross-boundary ?principal has EFFECTIVE fsx:CreateVolumeFromBackup on ?backup

emit

source type	`Identity`
target type	`Backup`
source	`?principal`
target	`?backup`
permissions	`fsx:CreateVolumeFromBackup`
conditions	`iam_permission` `region_or_boundary`
state logic	ACTIVE if the identity policy grants fsx:CreateVolumeFromBackup on the backup ARN in the same account and the principal can restore to an ONTAP file system they control (administrative access to the target FS); CONDITIONAL(region_or_boundary) if the permission is confirmed but the target file system access or network reachability is not yet confirmed; POTENTIAL if fsx:CreateVolumeFromBackup is broadly granted but target file system control is not confirmed.

Narrative

{principal.name} holds fsx:CreateVolumeFromBackup on {backup.name} (ONTAP volume backup, same account). This enables lateral movement: the attacker can restore the volume to an ONTAP file system they control, obtaining complete read access to the volume's data (NFS/CIFS/iSCSI exports and LUNs) without crossing account boundaries.

Raw rule rules/derived/aws/fsx.yaml

id: aws-fsx-ontap-volume-restore-from-backup
emits: CanReadData
description: An identity with fsx:CreateVolumeFromBackup on an ONTAP volume backup (same account) can
  restore the volume to an ONTAP file system they control, achieving lateral movement and data access
  to the restored volume.
match:
- - principal: null
  - HasPermission
  - backup: null
where:
- node_type(?backup) == Backup
- ?backup.provider_type == 'AWS::FSx::Backup'
- '?backup.properties.FileSystemType == ''ONTAP''  # backup is from an ONTAP file system or volume'
- '?principal.account == ?backup.account  # same-account: not cross-boundary'
- ?principal has EFFECTIVE fsx:CreateVolumeFromBackup on ?backup
emit:
  source_type: Identity
  target_type: Backup
  source: ?principal
  target: ?backup
  permissions:
  - fsx:CreateVolumeFromBackup
  conditions:
  - iam_permission
  - region_or_boundary
  state_logic: ACTIVE if the identity policy grants fsx:CreateVolumeFromBackup on the backup ARN in the
    same account and the principal can restore to an ONTAP file system they control (administrative access
    to the target FS); CONDITIONAL(region_or_boundary) if the permission is confirmed but the target file
    system access or network reachability is not yet confirmed; POTENTIAL if fsx:CreateVolumeFromBackup
    is broadly granted but target file system control is not confirmed.
  confidence: 0.75
  derived_from:
  - ?principal HasPermission fsx:CreateVolumeFromBackup on ?backup
  false_positive_note: This rule applies only to same-account ONTAP volume restores. Do not emit for cross-account
    backups (use rule 1, CanExfiltrate, instead). The restored volume must land in an ONTAP file system
    the attacker controls (or has read/admin access to via OS-level mount permissions). Confirm that the
    principal has administrative access (via ONTAP fsxadmin credential or NFS/SMB/iSCSI export permissions)
    to the destination file system before emitting ACTIVE. This rule models ONTAP-specific volume restore;
    use rule 5 (CreateFileSystemFromBackup) for full file system restore.
  narrative: '{principal.name} holds fsx:CreateVolumeFromBackup on {backup.name} (ONTAP volume backup,
    same account). This enables lateral movement: the attacker can restore the volume to an ONTAP file
    system they control, obtaining complete read access to the volume''s data (NFS/CIFS/iSCSI exports
    and LUNs) without crossing account boundaries.'