aws-lf-get-data-access-read

id: aws-lf-get-data-access-read
emits: CanReadData
description: An effective Lake Formation SELECT grant on a governed table, combined with IAM permission
  to call an analytics service (Athena, Glue, EMR, Redshift Spectrum, SageMaker), enables reading the
  underlying S3 data via LF-vended credentials (lakeformation:GetDataAccess called internally by the service).
match:
- - principal: null
  - HasPermission
  - table: null
where:
- node_type(?table) == DataWarehouse
- ?table.provider_type in ['AWS::Glue::Table', 'AWS::Glue::Database']
- '?table.lf_permissions contains at least one of: [SELECT, ALL, ALL_TABLES]'
- "?principal holds IAM permission to call AT LEAST ONE analytics service that can execute a SELECT query\
  \ against the table: athena:StartQueryExecution (direct query execution) OR glue:StartJobRun (Glue ETL\
  \ job; principal CanExecuteAs the job's service role,\n  which itself must hold HasPermission(SELECT)\
  \ on the table)\nOR elasticmapreduce:AddJobFlowSteps (EMR cluster steps; similar execution-role path)\
  \ OR redshift-data:ExecuteStatement (Redshift Serverless / Data API path;\n  cluster's service role\
  \ holds LF SELECT)\nOR sagemaker:CreateProcessingJob (SageMaker processing job; job's execution role\n\
  \  must hold LF SELECT)\nConfirmed effective at their respective resource scope."
emit:
  source_type: Identity
  target_type: DataWarehouse
  source: ?principal
  target: ?table
  permissions:
  - lakeformation:GetDataAccess
  - athena:StartQueryExecution | glue:StartJobRun | elasticmapreduce:AddJobFlowSteps | redshift-data:ExecuteStatement
    | sagemaker:CreateProcessingJob
  conditions:
  - iam_permission
  - resource_policy
  state_logic: 'ACTIVE when BOTH gates are confirmed: (1) the principal has an effective LF SELECT grant
    on the target table (HasPermission confirmed by explicit rule aws-lf-existing-grants), AND (2) the
    principal has effective IAM permission to call at least one analytics service that can query the table
    (Athena/Glue/EMR/ Redshift/SageMaker). For indirect paths (job execution roles), the principal must
    have CanExecuteAs on the job role AND the job role must have HasPermission(SELECT) on the table. CONDITIONAL(iam_permission)
    when the analytics-service IAM permission is unconfirmed or gated by a permission boundary. CONDITIONAL(resource_policy)
    when the LF grant is unconfirmed or gated by column-level / row-level filters (cell-level security
    narrows actual data access). BLOCKED by an SCP or explicit deny on the analytics service call or on
    lakeformation:GetDataAccess at the service-execution level. Inherit weakest from HasPermission and
    analytics-service HasPermission contributors.'
  confidence: min(contributing_confidences) * 0.90
  derived_from:
  - ?principal HasPermission ?table (LF SELECT grant, explicit rule aws-lf-existing-grants)
  - ?principal HasPermission analytics_service (Athena/Glue/EMR/Redshift/SageMaker IAM permission)
  - can-execute-as linchpin (for indirect job execution paths)
  false_positive_note: "TWO GATES REQUIRED: both the LF data-lake permission (SELECT on the table) AND\
    \ the IAM permission to call the analytics service must be confirmed effective. A principal with only\
    \ the IAM permission but no LF SELECT grant will receive an LF AccessDeniedException when the analytics\
    \ service calls GetDataAccess. A principal with the LF SELECT grant but no IAM permission to call\
    \ the analytics service cannot execute a query. Emit ACTIVE only when both are confirmed. For indirect\
    \ paths (Glue jobs, EMR steps), the principal does NOT need LF SELECT themselves \u2014 only the job\
    \ role does. The path is: principal CanTrigger/CanExecuteAs the job role + job role HasPermission(SELECT).\
    \ Additionally: (a) column-level security (LF column filters on the grant) limits which columns are\
    \ readable \u2014 scope CanReadData to the columns actually granted; (b) row-level (cell-level) security\
    \ further limits accessible rows; (c) if the S3 location is NOT registered as an LF location, LF permissions\
    \ do not apply \u2014 do not emit this rule for unregistered S3 buckets; (d) the LF permission must\
    \ be on the TABLE node, not just on a parent database (unless ALL_TABLES in the database is granted);\
    \ (e) TBAC (tag-based access control) grants via LF-tag expressions may not be captured if the explicit\
    \ rule aws-lf-existing-grants only records direct grants \u2014 cross-check ListPermissions for TBAC\
    \ grants on matching tagged resources. An LF admin bypasses the LF-grant gate (gate (a)) but still\
    \ needs the analytics-service IAM permission."
  narrative: '{principal.name} holds an effective Lake Formation SELECT grant on {table.name} and has
    IAM permission to query it via an analytics service (Athena / Glue ETL / EMR / Redshift Spectrum /
    SageMaker). Lake Formation internally vends temporary S3 credentials (lakeformation:GetDataAccess)
    to the analytics service, enabling {principal.name} to read the raw underlying data in the registered
    S3 location.'