aws-lf-put-datalake-settings-admin

lakeformation:PutDataLakeSettings lets a principal add themselves to the Lake Formation DataLakeAdmins list, after which ALL LF permission checks are bypassed for that principal - they can grant any data permission to any principal, read any governed table, and modify any registered location. Emits CanGrantPermission (nature:both) to feed into can-control linchpin for escalation roll-up.

derived aws emits CanGrantPermission

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'data_lake': None}

where

node_type(?data_lake) == DataLake ?data_lake.provider_type == 'AWS::LakeFormation::DataLake' ?principal has EFFECTIVE lakeformation:PutDataLakeSettings on resource '*'

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`?principal`
permissions	`lakeformation:PutDataLakeSettings`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when lakeformation:PutDataLakeSettings is confirmed EFFECTIVE for ?principal on resource '' (this action requires resource '' — it cannot be scoped to individual tables or databases). CONDITIONAL(scp_or_org_policy) when an SCP is present but its effective deny on lakeformation:PutDataLakeSettings is unconfirmed. BLOCKED by an explicit SCP or permission boundary deny on lakeformation:PutDataLakeSettings. Inherit weakest from HasPermission contributor.

Narrative

{principal.name} has effective lakeformation:PutDataLakeSettings and can add itself to the Lake Formation DataLakeAdmins list. As an LF admin, ALL LF permission checks are bypassed account-wide: the principal can grant any data permission to any principal, read any governed table, and modify any registered S3 location. This is the highest-privilege escalation action in Lake Formation.

Raw rule rules/derived/aws/lakeformation.yaml

id: aws-lf-put-datalake-settings-admin
emits: CanGrantPermission
description: "lakeformation:PutDataLakeSettings lets a principal add themselves to the Lake Formation\
  \ DataLakeAdmins list, after which ALL LF permission checks are bypassed for that principal \u2014 they\
  \ can grant any data permission to any principal, read any governed table, and modify any registered\
  \ location. Emits CanGrantPermission (nature:both) to feed into can-control linchpin for escalation\
  \ roll-up."
match:
- - principal: null
  - HasPermission
  - data_lake: null
where:
- node_type(?data_lake) == DataLake
- ?data_lake.provider_type == 'AWS::LakeFormation::DataLake'
- ?principal has EFFECTIVE lakeformation:PutDataLakeSettings on resource '*'
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?principal
  permissions:
  - lakeformation:PutDataLakeSettings
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: "ACTIVE when lakeformation:PutDataLakeSettings is confirmed EFFECTIVE for ?principal on\
    \ resource '*' (this action requires resource '*' \u2014 it cannot be scoped to individual tables\
    \ or databases). CONDITIONAL(scp_or_org_policy) when an SCP is present but its effective deny on lakeformation:PutDataLakeSettings\
    \ is unconfirmed. BLOCKED by an explicit SCP or permission boundary deny on lakeformation:PutDataLakeSettings.\
    \ Inherit weakest from HasPermission contributor."
  confidence: min(contributing_confidences) * 0.98
  derived_from:
  - ?principal HasPermission ?data_lake (lakeformation:PutDataLakeSettings effective)
  - "can-control:control-via-admin (downstream CanEscalateTo \u2014 cited not re-derived)"
  false_positive_note: "lakeformation:PutDataLakeSettings acts on the data lake resource, which can only\
    \ be scoped to '*' in IAM (it is not resource-level-restricted). Confirm the effective permission\
    \ accounts for permission boundaries and SCPs; an org SCP denying lakeformation:PutDataLakeSettings\
    \ is the primary defensive control. The CanEscalateTo consequence (admin > normal privilege) is produced\
    \ by can-control's escalate-via-execute-as / control-via-admin \u2014 cite, do not re-derive here.\
    \ Additionally, PutDataLakeSettings can modify the data lake's default permission mode to disable\
    \ LF enforcement for new resources; setting CreateDatabaseDefaultPermissions and CreateTableDefaultPermissions\
    \ to empty [] removes LF as a mandatory gate for new catalog objects."
  narrative: '{principal.name} has effective lakeformation:PutDataLakeSettings and can add itself to the
    Lake Formation DataLakeAdmins list. As an LF admin, ALL LF permission checks are bypassed account-wide:
    the principal can grant any data permission to any principal, read any governed table, and modify
    any registered S3 location. This is the highest-privilege escalation action in Lake Formation.'