aws-lightsail-set-bucket-resource-access
Granting resource access to a bucket makes its objects readable by an instance/account principal.
match (effective permission)
{
"action": "lightsail:SetResourceAccessForBucket",
"resource_type": "AWS::Lightsail::Bucket"
}
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <Lightsail bucket in scope> |
| permissions | lightsail:SetResourceAccessForBucket |
Narrative
{principal.name} can grant resource access to bucket {target.name} (lightsail:SetResourceAccessForBucket), making its objects readable by an instance/account principal.
Raw rule rules/derived/aws/lightsail.yaml
id: aws-lightsail-set-bucket-resource-access
emits: CanModifyConfiguration
description: Granting resource access to a bucket makes its objects readable by an instance/account principal.
match_effective_permission:
action: lightsail:SetResourceAccessForBucket
resource_type: AWS::Lightsail::Bucket
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <Lightsail bucket in scope>
permissions:
- lightsail:SetResourceAccessForBucket
escalation: Grant an instance (or account) read/write access to bucket objects without minting a data-plane
key -> widened data access.
false_positive_note: SetResourceAccessForBucket changes the bucket's access policy so a named Lightsail
resource can read its objects; it is a config/resource-policy change, not itself a data read. Value
depends on the granted principal being attacker-reachable.
narrative: '{principal.name} can grant resource access to bucket {target.name} (lightsail:SetResourceAccessForBucket),
making its objects readable by an instance/account principal.'