aws-fsx-same-account-backup-restore
An identity with fsx:CreateFileSystemFromBackup on a same-account backup can restore the data to a new file system in a different VPC or AD domain, achieving lateral movement and data access within the same account.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?backup) ==
Backup
?backup.provider_type == 'AWS::FSx::Backup'
?principal.account == ?backup.account # same-account: not cross-boundary
?principal has EFFECTIVE fsx:CreateFileSystemFromBackup on ?backup
emit
| source type | Identity |
|---|---|
| target type | Backup |
| source | ?principal |
| target | ?backup |
| permissions | fsx:CreateFileSystemFromBackup |
| conditions | iam_permission region_or_boundary |
| state logic | ACTIVE if the identity policy grants fsx:CreateFileSystemFromBackup on the backup ARN in the same account and the principal can restore to a different VPC/AD domain they control; CONDITIONAL(region_or_boundary) if the permission is confirmed but restore success depends on network reachability or AD domain trust in the destination environment; POTENTIAL if fsx:CreateFileSystemFromBackup is broadly granted but destination VPC/AD reachability is not confirmed. |
Narrative
{principal.name} holds fsx:CreateFileSystemFromBackup on {backup.name} (same account, different VPC/AD domain). This enables lateral movement: the attacker can restore the backup to a new file system in a segment they control, obtaining complete read access to all data from the backup without crossing account boundaries.
Raw rule rules/derived/aws/fsx.yaml
id: aws-fsx-same-account-backup-restore
emits: CanReadData
description: An identity with fsx:CreateFileSystemFromBackup on a same-account backup can restore the
data to a new file system in a different VPC or AD domain, achieving lateral movement and data access
within the same account.
match:
- - principal: null
- HasPermission
- backup: null
where:
- node_type(?backup) == Backup
- ?backup.provider_type == 'AWS::FSx::Backup'
- '?principal.account == ?backup.account # same-account: not cross-boundary'
- ?principal has EFFECTIVE fsx:CreateFileSystemFromBackup on ?backup
emit:
source_type: Identity
target_type: Backup
source: ?principal
target: ?backup
permissions:
- fsx:CreateFileSystemFromBackup
conditions:
- iam_permission
- region_or_boundary
state_logic: ACTIVE if the identity policy grants fsx:CreateFileSystemFromBackup on the backup ARN in
the same account and the principal can restore to a different VPC/AD domain they control; CONDITIONAL(region_or_boundary)
if the permission is confirmed but restore success depends on network reachability or AD domain trust
in the destination environment; POTENTIAL if fsx:CreateFileSystemFromBackup is broadly granted but
destination VPC/AD reachability is not confirmed.
confidence: 0.75
derived_from:
- ?principal HasPermission fsx:CreateFileSystemFromBackup on ?backup
false_positive_note: This rule applies only to same-account restores. Do not emit for cross-account
backups (use rule 1, CanExfiltrate, instead). The restored file system must be in a different VPC/AD
domain from the original for this to constitute meaningful lateral movement; otherwise it is a same-VPC/AD
data read. Confirm destination VPC/AD reachability before emitting ACTIVE.
narrative: '{principal.name} holds fsx:CreateFileSystemFromBackup on {backup.name} (same account, different
VPC/AD domain). This enables lateral movement: the attacker can restore the backup to a new file system
in a segment they control, obtaining complete read access to all data from the backup without crossing
account boundaries.'