BlockStorage

CreateSnapshot + ModifySnapshotAttribute(add=<external account>) lets an attacker ship a full disk image to an account they control. The rule matches on the CanWrite capability on a volume and confirms effective IAM permissions for both snapshot creation and cross-account sharing.

A volume is attached to an EC2 instance via ec2:DescribeVolumes.

Detaching a volume from a victim instance, attaching it to an attacker-controlled instance, modifying the filesystem (cron, SSH keys, startup scripts), and re-attaching enables both data write and indirect CanModifyConfiguration on the victim instance. This is the inverse of aws-ebs-volume-mount-read.

CreateVolume from an existing snapshot + AttachVolume to an attacker- controlled instance yields full filesystem read of the snapshot's data. This rule matches on direct IAM capability evaluation for both volume creation and attachment.

Wildcard permission on disks grants full control of the disk resource.

An attacker who can SAS-export a CMK-encrypted managed disk downloads encrypted VHD blobs; plaintext read requires decrypt on the wrapping DES key (CONDITIONAL). When the same principal also holds CanDecrypt on the DES Key Vault key the decrypt-gates-secret-read rule in credential-chains.yaml upgrades to ACTIVE.

An OS-type managed disk (Windows or Linux) is heuristically classified as containing credential material: SAM/NTDS hive, /etc/shadow, SSH private keys, or application credential files.

A principal with CanModifyConfiguration(DES) can upgrade a CONDITIONAL(key_permission) CanReadData edge to ACTIVE by pointing the DES at an attacker-controlled Key Vault key and triggering VM lifecycle (re-encrypt under attacker key on next attach/detach).

A disk that can be SAS-exported and contains secrets exposes those credentials as accessible to external parties. The state (ACTIVE vs CONDITIONAL) depends on the CanExfiltrate edge state.

An attacker who can SAS-export a PMK-encrypted or unencrypted managed disk can read the plaintext data immediately upon download (no key gate).

beginGetAccess/action on a disk with AllowAll (default) network access policy mints an internet-routable anonymous SAS download URL for the full VHD.

beginGetAccess/action on a disk with AllowPrivate network access policy mints a SAS download URL accessible only via the private endpoint.

disks/write allows changing networkAccessPolicy (e.g. from AllowPrivate to AllowAll), which upgrades CONDITIONAL(network_reachability) SAS-export edges to ACTIVE.

A snapshot of an OS-type disk inherits the OS-disk ContainsSecret classification when the source disk is identified.