aws-s3-write-data-put-object

s3:PutObject on a bucket grants data-plane write, enabling object creation/overwrite - including code artifact poisoning.

derived aws emits CanWriteData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`ObjectStorage`
source	`?principal`
target	`?bucket`
permissions	`s3:PutObject`
conditions	`iam_permission` `resource_policy` `scp_or_org_policy`
state logic	ACTIVE when s3:PutObject is confirmed EFFECTIVE (identity policy + bucket policy; no SCP or boundary deny). Object Lock (COMPLIANCE or GOVERNANCE mode) prevents overwriting locked objects — downgrade to CONDITIONAL(iam_permission) for locked objects; unlocked objects are ACTIVE. BLOCKED by an explicit SCP or bucket-policy Deny on s3:PutObject.

source type

Identity

target type

ObjectStorage

source

?principal

target

?bucket

permissions

s3:PutObject

conditions

iam_permission resource_policy scp_or_org_policy

state logic

ACTIVE when s3:PutObject is confirmed EFFECTIVE (identity policy + bucket policy; no SCP or boundary deny). Object Lock (COMPLIANCE or GOVERNANCE mode) prevents overwriting locked objects — downgrade to CONDITIONAL(iam_permission) for locked objects; unlocked objects are ACTIVE. BLOCKED by an explicit SCP or bucket-policy Deny on s3:PutObject.

Narrative

{principal.name} has s3:PutObject on {bucket.name} and can create or overwrite any object in the bucket - including code artifacts consumed by downstream services.

Raw rule rules/derived/aws/s3.yaml

id: aws-s3-write-data-put-object
emits: CanWriteData
description: "s3:PutObject on a bucket grants data-plane write, enabling object creation/overwrite \u2014\
  \ including code artifact poisoning."
match:
- - principal: null
  - HasPermission
  - bucket: null
where:
- node_type(?bucket) == ObjectStorage
- ?bucket.provider_type == 'AWS::S3::Bucket'
- ?principal has EFFECTIVE s3:PutObject on ?bucket ARN (identity-based policy + bucket policy jointly
  permit)
emit:
  source_type: Identity
  target_type: ObjectStorage
  source: ?principal
  target: ?bucket
  permissions:
  - s3:PutObject
  conditions:
  - iam_permission
  - resource_policy
  - scp_or_org_policy
  state_logic: "ACTIVE when s3:PutObject is confirmed EFFECTIVE (identity policy + bucket policy; no SCP\
    \ or boundary deny). Object Lock (COMPLIANCE or GOVERNANCE mode) prevents overwriting locked objects\
    \ \u2014 downgrade to CONDITIONAL(iam_permission) for locked objects; unlocked objects are ACTIVE.\
    \ BLOCKED by an explicit SCP or bucket-policy Deny on s3:PutObject."
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - ?principal HasPermission ?bucket (s3:PutObject effective permission)
  false_positive_note: "S3 Object Lock (retention policy in COMPLIANCE mode) prevents overwriting or deleting\
    \ objects during the retention period \u2014 the write is BLOCKED for locked objects; ACTIVE for unlocked/unversioned\
    \ objects in the same bucket. If the bucket has Versioning=Enabled, a PutObject creates a new version\
    \ but does not delete the previous one: downstream services that resolve the latest version are still\
    \ poisoned; services with pinned version IDs are not. s3:PutObject scoped by key prefix limits impact\
    \ to that prefix scope."
  narrative: "{principal.name} has s3:PutObject on {bucket.name} and can create or overwrite any object\
    \ in the bucket \u2014 including code artifacts consumed by downstream services."