aws-fsx-put-resource-policy-cross-account-grant

An identity with fsx:PutResourcePolicy on an FSx backup can rewrite the backup's resource policy to grant an external account fsx:CopyBackup access, staging a cross-account backup exfil without touching the live file system.

derived aws emits CanModifyPolicy

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`ResourcePolicy`
source	`?principal`
target	`<ResourcePolicy node attached to ?backup>`
permissions	`fsx:PutResourcePolicy`
conditions	`iam_permission`
state logic	ACTIVE if ?principal has confirmed effective fsx:PutResourcePolicy on the backup ARN (no deny from SCP/boundary); CONDITIONAL(iam_permission) if the grant is present but an SCP or permission boundary may deny it; BLOCKED if an explicit deny or SCP on fsx:PutResourcePolicy applies.

source type

Identity

target type

ResourcePolicy

source

?principal

target

<ResourcePolicy node attached to ?backup>

permissions

fsx:PutResourcePolicy

conditions

iam_permission

state logic

ACTIVE if ?principal has confirmed effective fsx:PutResourcePolicy on the backup ARN (no deny from SCP/boundary); CONDITIONAL(iam_permission) if the grant is present but an SCP or permission boundary may deny it; BLOCKED if an explicit deny or SCP on fsx:PutResourcePolicy applies.

Narrative

{principal.name} can call fsx:PutResourcePolicy on {backup.name}'s resource policy to grant an attacker-controlled external account fsx:CopyBackup access, staging a cross-account exfil path that does not touch the live file system.

Raw rule rules/derived/aws/fsx.yaml

id: aws-fsx-put-resource-policy-cross-account-grant
emits: CanModifyPolicy
description: An identity with fsx:PutResourcePolicy on an FSx backup can rewrite the backup's resource
  policy to grant an external account fsx:CopyBackup access, staging a cross-account backup exfil without
  touching the live file system.
match:
- - principal: null
  - HasPermission
  - backup: null
where:
- node_type(?backup) == Backup
- ?backup.provider_type == 'AWS::FSx::Backup'
- ?principal has EFFECTIVE fsx:PutResourcePolicy on ?backup
emit:
  source_type: Identity
  target_type: ResourcePolicy
  source: ?principal
  target: <ResourcePolicy node attached to ?backup>
  permissions:
  - fsx:PutResourcePolicy
  conditions:
  - iam_permission
  state_logic: ACTIVE if ?principal has confirmed effective fsx:PutResourcePolicy on the backup ARN (no
    deny from SCP/boundary); CONDITIONAL(iam_permission) if the grant is present but an SCP or permission
    boundary may deny it; BLOCKED if an explicit deny or SCP on fsx:PutResourcePolicy applies.
  confidence: 0.8
  derived_from:
  - ?principal HasPermission fsx:PutResourcePolicy on ?backup
  false_positive_note: This rule models the CAPABILITY to rewrite the backup policy, not an existing cross-account
    grant. An SCP deny on fsx:PutResourcePolicy blocks this path entirely. Honor iam:ResourceTag conditions
    that might scope PutResourcePolicy to specific backup tags. The downstream CrossAccountTrust (via
    fsx:GetResourcePolicy observation) plus CopyBackup exfil (rule 1) still requires the actual policy
    write plus a separate copy call by the external account.
  narrative: '{principal.name} can call fsx:PutResourcePolicy on {backup.name}''s resource policy to grant
    an attacker-controlled external account fsx:CopyBackup access, staging a cross-account exfil path
    that does not touch the live file system.'