aws-lf-grant-permissions-self-grant

id: aws-lf-grant-permissions-self-grant
emits: CanGrantPermission
description: lakeformation:GrantPermissions lets a principal grant LF data-lake permissions (SELECT /
  INSERT / DATA_LOCATION_ACCESS / etc.) to ANY principal, including themselves. This sub-rule captures
  the self-grant case (principal -> principal), the privilege escalation primitive in Lake Formation.
match:
- - principal: null
  - HasPermission
  - data_lake: null
where:
- node_type(?data_lake) == DataLake
- ?data_lake.provider_type == 'AWS::LakeFormation::DataLake'
- ?principal has EFFECTIVE lakeformation:GrantPermissions (or lakeformation:BatchGrantPermissions) on
  the target catalog resource scope (explicit rule aws-lf-can-grant-permission confirms this) AND (?principal
  is an LF admin (GetDataLakeSettings confirms principal in DataLakeAdmins list) OR ?principal holds the
  target LF permission WITH GRANT OPTION on the specific resource)
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?principal
  permissions:
  - lakeformation:GrantPermissions
  - lakeformation:BatchGrantPermissions
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: "ACTIVE when ?principal is an LF admin (GetDataLakeSettings lists principal in DataLakeAdmins)\
    \ \u2014 unrestricted GrantPermissions on any resource. ACTIVE when ?principal holds the specific\
    \ target LF permission WITH GRANT OPTION confirmed on the resource (ListPermissions confirms GrantOption:\
    \ true for the principal's grant record on the target resource). CONDITIONAL(iam_permission) when\
    \ lakeformation:GrantPermissions effective permission is unconfirmed (boundary / SCP may cap it).\
    \ BLOCKED by an SCP or permission boundary that explicitly denies lakeformation:GrantPermissions.\
    \ Inherit weakest from CanGrantPermission contributor."
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - ?principal HasPermission ?data_lake (lakeformation:GrantPermissions via explicit rule aws-lf-can-grant-permission)
  - ?principal in DataLakeAdmins (explicit rule aws-lf-admin-list) OR holds target permission WITH GRANT
    OPTION (ListPermissions via explicit rule aws-lf-existing-grants)
  false_positive_note: "CRITICAL: honor the GRANT OPTION gate. A non-admin principal can only re-grant\
    \ what they THEMSELVES hold with GRANT OPTION. If the principal's ListPermissions grant record shows\
    \ GrantOption: false, they cannot re-grant even if they hold lakeformation:GrantPermissions in IAM\
    \ \u2014 IAM allows the API call but LF will reject the grant attempt. LF admins bypass this entirely.\
    \ Do NOT emit ACTIVE for a non-admin principal without GRANT OPTION on the target resource. Scope\
    \ to the specific resources the principal can grant (LF admin = all; GRANT OPTION holder = only their\
    \ granted resources). An SCP denying lakeformation:GrantPermissions at the org level blocks even LF\
    \ admins at the IAM layer."
  narrative: "{principal.name} has effective lakeformation:GrantPermissions and (as an LF admin or GRANT\
    \ OPTION holder) can grant any LF data-lake permission \u2014 including SELECT on governed tables\
    \ \u2014 to itself. Self-granting SELECT enables reading the underlying S3 data via Athena, Glue,\
    \ or EMR (CanReadData via rule 3)."