rage.fail

aws-lf-get-datalake-settings-recon

explicit aws emits CanRead

match (effective permission)

{ "action": "lakeformation:GetDataLakeSettings", "resource_type": "AWS::LakeFormation::DataLake" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<DataLake node>`
permissions	`lakeformation:GetDataLakeSettings`

Narrative

{principal.name} has effective lakeformation:GetDataLakeSettings and can read the Lake Formation admin list (DataLakeAdmins) and account-wide configuration - useful for identifying privilege escalation targets.

Raw rule rules/explicit/aws-lakeformation.yaml

id: aws-lf-get-datalake-settings-recon
emits: CanRead
applies_to:
- aws
match_effective_permission:
  action: lakeformation:GetDataLakeSettings
  resource_type: AWS::LakeFormation::DataLake
emit:
  target_type: '*'
  source_type: Identity
  source: <principal>
  target: <DataLake node>
  permissions:
  - lakeformation:GetDataLakeSettings
  narrative: "{principal.name} has effective lakeformation:GetDataLakeSettings and can read the Lake Formation\
    \ admin list (DataLakeAdmins) and account-wide configuration \u2014 useful for identifying privilege\
    \ escalation targets."