rage.fail

aws-lightsail-export-snapshot

derived aws emits CanExfiltrate

match (effective permission)

{ "action": "lightsail:ExportSnapshot", "resource_type": "AWS::Lightsail::InstanceSnapshot" }

emit

source	`<principal>`
target	`<Lightsail instance/disk snapshot in scope>`
permissions	`lightsail:ExportSnapshot`
conditions	`iam_permission`

Narrative

{principal.name} can export snapshot {target.name} to EC2/EBS (lightsail:ExportSnapshot); harvesting its contents requires follow-on EC2/EBS mount permissions.

Raw rule rules/derived/aws/lightsail.yaml

id: aws-lightsail-export-snapshot
emits: CanExfiltrate
match_effective_permission:
  action: lightsail:ExportSnapshot
  resource_type: AWS::Lightsail::InstanceSnapshot
emit:
  source: <principal>
  target: <Lightsail instance/disk snapshot in scope>
  permissions:
  - lightsail:ExportSnapshot
  conditions:
  - iam_permission
  escalation: Export a Lightsail snapshot to EC2/EBS, then mount the volume offline to read secrets, keys,
    and role config (requires EC2/EBS permissions on the follow-on).
  false_positive_note: ExportSnapshot lands the image in EC2/EBS in the SAME account; reading its contents
    requires separate EC2/EBS permissions (ec2:DescribeSnapshots, ec2:CreateVolume, ec2:AttachVolume /
    OS mount) the Lightsail principal may not hold. Emit the harvest continuation only when those EC2-side
    permissions are present.
  narrative: '{principal.name} can export snapshot {target.name} to EC2/EBS (lightsail:ExportSnapshot);
    harvesting its contents requires follow-on EC2/EBS mount permissions.'