aws-lightsail-create-instance-from-snapshot

id: aws-lightsail-create-instance-from-snapshot
emits: CanExfiltrate
description: Standing up an instance from someone else's snapshot exposes the snapshot's on-disk contents
  within the account.
match_effective_permission:
  action: lightsail:CreateInstancesFromSnapshot
  resource_type: AWS::Lightsail::InstanceSnapshot
optional_permission: lightsail:CopySnapshot
emit:
  source: <principal>
  target: <source Lightsail instance/disk snapshot in scope>
  permissions:
  - lightsail:CreateInstancesFromSnapshot
  - lightsail:CopySnapshot?
  conditions:
  - network_reachability
  - service_state
  escalation: Rebuild an instance from an existing snapshot (attacker may supply keyName at create ->
    attacker-keyed OS access), then read the snapshot's disk contents (secrets, keys, role config).
  false_positive_note: 'Within-account analog of ExportSnapshot: reading the disk requires OS access to
    the new instance (attacker-supplied keyName or default key pair) and network reachability. Absent
    OS access this is instance creation, not a completed read.'
  narrative: '{principal.name} can create an instance from snapshot {target.name} (lightsail:CreateInstancesFromSnapshot),
    optionally supplying an attacker key pair, to read the snapshot''s disk contents.'