aws-redshift-serverless-snapshot-cross-account-exfil

redshift-serverless:UpdateSnapshot allows sharing a Redshift Serverless snapshot with another AWS account, enabling full data exfiltration via restore.

derived aws emits CanExfiltrate

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Snapshot`
source	`?principal`
target	`?snapshot`
permissions	`redshift-serverless:UpdateSnapshot`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when redshift-serverless:UpdateSnapshot is confirmed EFFECTIVE on the snapshot ARN. CONDITIONAL(iam_permission) when SCP/boundary restriction is unresolved. BLOCKED by explicit SCP deny. The target account must then call RestoreFromClusterSnapshot on the Serverless snapshot to realize the exfil.

source type

Identity

target type

Snapshot

source

?principal

target

?snapshot

permissions

redshift-serverless:UpdateSnapshot

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE when redshift-serverless:UpdateSnapshot is confirmed EFFECTIVE on the snapshot ARN. CONDITIONAL(iam_permission) when SCP/boundary restriction is unresolved. BLOCKED by explicit SCP deny. The target account must then call RestoreFromClusterSnapshot on the Serverless snapshot to realize the exfil.

Narrative

{principal.name} can update Redshift Serverless snapshot {snapshot.name}, including sharing it with an external AWS account (redshift-serverless:UpdateSnapshot). The external account can then restore a full copy of the namespace data - complete warehouse exfiltration.

Raw rule rules/derived/aws/redshift.yaml

id: aws-redshift-serverless-snapshot-cross-account-exfil
emits: CanExfiltrate
description: redshift-serverless:UpdateSnapshot allows sharing a Redshift Serverless snapshot with another
  AWS account, enabling full data exfiltration via restore.
match:
- - principal: null
  - HasPermission
  - snapshot: null
where:
- node_type(?snapshot) == Snapshot
- ?snapshot.provider_type == 'AWS::RedshiftServerless::Snapshot'
- ?principal has EFFECTIVE redshift-serverless:UpdateSnapshot on ?snapshot ARN
emit:
  source_type: Identity
  target_type: Snapshot
  source: ?principal
  target: ?snapshot
  permissions:
  - redshift-serverless:UpdateSnapshot
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when redshift-serverless:UpdateSnapshot is confirmed EFFECTIVE on the snapshot ARN.
    CONDITIONAL(iam_permission) when SCP/boundary restriction is unresolved. BLOCKED by explicit SCP deny.
    The target account must then call RestoreFromClusterSnapshot on the Serverless snapshot to realize
    the exfil.
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - ?principal HasPermission ?snapshot (redshift-serverless:UpdateSnapshot effective permission)
  false_positive_note: UpdateSnapshot is the Serverless snapshot-update action covering both metadata
    changes and restore-access list updates. The restore-access change is scoped by whether the snapshot
    exists and is not already deleted. KMS-encrypted snapshots (CMK) require kms:Decrypt in the target
    account.
  narrative: "{principal.name} can update Redshift Serverless snapshot {snapshot.name}, including sharing\
    \ it with an external AWS account (redshift-serverless:UpdateSnapshot). The external account can then\
    \ restore a full copy of the namespace data \u2014 complete warehouse exfiltration."