aws-s3-hijack-notification-config
s3:PutBucketNotification lets a principal reconfigure event notification targets (Lambda/SQS/SNS/EventBridge) for a bucket, redirecting all S3 events to attacker-controlled destinations.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?bucket) ==
ObjectStorage
?bucket.provider_type == 'AWS::S3::Bucket'
?principal has EFFECTIVE s3:PutBucketNotification on ?bucket ARN
emit
| source type | Identity |
|---|---|
| target type | ObjectStorage |
| source | ?principal |
| target | ?bucket |
| permissions | s3:PutBucketNotification |
| conditions | iam_permission scp_or_org_policy |
| state logic | ACTIVE when s3:PutBucketNotification is confirmed EFFECTIVE on the bucket ARN. BLOCKED by an SCP or permission boundary deny. The actual trigger-hijacking impact depends on existing event notification consumers — if the bucket has no consumers, the configuration change has no immediate execution impact (CONDITIONAL(trigger_exists) for the downstream CanTrigger consequence); if existing Lambda/SQS targets depend on the bucket's events, redirecting them is immediately impactful (ACTIVE). Emit CanModifyConfiguration regardless; the downstream impact is analyzed separately. |
Narrative
{principal.name} has s3:PutBucketNotification on {bucket.name} and can reconfigure S3 event notification targets - redirecting all object-created or removed events to an attacker-controlled Lambda, SQS queue, or SNS topic.
Raw rule rules/derived/aws/s3.yaml
id: aws-s3-hijack-notification-config
emits: CanModifyConfiguration
description: s3:PutBucketNotification lets a principal reconfigure event notification targets (Lambda/SQS/SNS/EventBridge)
for a bucket, redirecting all S3 events to attacker-controlled destinations.
match:
- - principal: null
- HasPermission
- bucket: null
where:
- node_type(?bucket) == ObjectStorage
- ?bucket.provider_type == 'AWS::S3::Bucket'
- ?principal has EFFECTIVE s3:PutBucketNotification on ?bucket ARN
emit:
source_type: Identity
target_type: ObjectStorage
source: ?principal
target: ?bucket
permissions:
- s3:PutBucketNotification
conditions:
- iam_permission
- scp_or_org_policy
state_logic: "ACTIVE when s3:PutBucketNotification is confirmed EFFECTIVE on the bucket ARN. BLOCKED\
\ by an SCP or permission boundary deny. The actual trigger-hijacking impact depends on existing event\
\ notification consumers \u2014 if the bucket has no consumers, the configuration change has no immediate\
\ execution impact (CONDITIONAL(trigger_exists) for the downstream CanTrigger consequence); if existing\
\ Lambda/SQS targets depend on the bucket's events, redirecting them is immediately impactful (ACTIVE).\
\ Emit CanModifyConfiguration regardless; the downstream impact is analyzed separately."
confidence: min(contributing_confidences) * 0.90
derived_from:
- ?principal HasPermission ?bucket (s3:PutBucketNotification effective permission)
false_positive_note: "s3:PutBucketNotification (the action name in IAM) controls notification configuration\
\ writes. The Lambda/SQS/SNS destination must grant S3 permission to invoke it (Lambda: resource-based\
\ policy; SQS: SQS queue policy; SNS: SNS policy). When redirecting to an attacker Lambda, the attacker's\
\ Lambda must allow s3.amazonaws.com to invoke it \u2014 but the attacker controls that Lambda and\
\ can configure it freely. When redirecting an existing notification, the existing consumer LOSES\
\ its events (disruption); when adding a duplicate target, both fire (stealth). Note that EventBridge\
\ (s3:PutBucketNotification for EventBridge configuration) routes events to EventBridge rules, not\
\ a specific target \u2014 the impact depends on existing EventBridge rules."
narrative: "{principal.name} has s3:PutBucketNotification on {bucket.name} and can reconfigure S3 event\
\ notification targets \u2014 redirecting all object-created or removed events to an attacker-controlled\
\ Lambda, SQS queue, or SNS topic."