aws-macie-findings-recon

Reading Macie findings (macie2:GetFindings) reveals the precise S3 objects and locations where sensitive data - credentials, API keys, PII - was detected. This is a recon / targeting primitive.

derived aws emits CanRead

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?macie_session`
permissions	`macie2:GetFindings`
state logic	if effective_permission includes macie2:GetFindings and no SCP/boundary denies it: ACTIVE else BLOCKED

source type

Identity

target type

SecurityService

source

?principal

target

?macie_session

permissions

macie2:GetFindings

state logic

if effective_permission includes macie2:GetFindings and no SCP/boundary denies it: ACTIVE else BLOCKED

Narrative

{principal.name} can read Amazon Macie findings (macie2:GetFindings), which identify the exact S3 objects and buckets where sensitive data - including AWS credentials, API keys, and PII - was detected. This provides a precise targeting map for exfiltration but does not itself grant access to those objects.

Raw rule rules/derived/aws/macie.yaml

id: aws-macie-findings-recon
emits: CanRead
description: "Reading Macie findings (macie2:GetFindings) reveals the precise S3 objects and locations\
  \ where sensitive data \u2014 credentials, API keys, PII \u2014 was detected. This is a recon / targeting\
  \ primitive."
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - macie_session: null
where:
- node_type(?macie_session) == SecurityService
- ?macie_session.provider_type == 'AWS::Macie::Session'
- effective_permission(?principal, ?macie_session) contains 'macie2:GetFindings'
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?macie_session
  permissions:
  - macie2:GetFindings
  state_logic: 'if effective_permission includes macie2:GetFindings and no SCP/boundary denies it: ACTIVE
    else BLOCKED'
  confidence: '0.85'
  derived_from:
  - ?principal HasPermission ?macie_session
  false_positive_note: "Reading findings is RECON only. A finding describes which S3 object contains a\
    \ credential or PII; it does NOT give the attacker that credential. Do NOT emit CanReadSecret or ExposesCredential\
    \ on the Macie session node itself \u2014 those edges belong on the S3 objects identified within the\
    \ findings, if modeled. For delegated-admin accounts (Macie Organizations integration), macie2:GetFindings\
    \ covers member-account findings; scope confidence to 0.80 when the principal is in the admin account\
    \ reading across org members (broader blast radius, same primitive)."
  narrative: "{principal.name} can read Amazon Macie findings (macie2:GetFindings), which identify the\
    \ exact S3 objects and buckets where sensitive data \u2014 including AWS credentials, API keys, and\
    \ PII \u2014 was detected. This provides a precise targeting map for exfiltration but does not itself\
    \ grant access to those objects."