DataLake
Lake Formation/ADLS/BigLake.
class: Data
Realizing resources
aws aws
| resource | scope | enumerate | required permissions |
|---|---|---|---|
aws:lakeformation:resource |
regional | lakeformation:ListResources |
lakeformation:ListResources |
azure azure
| resource | scope | enumerate | required permissions |
|---|---|---|---|
azure:datalake:store |
global | arg:microsoft.datalakestore/accounts |
Microsoft.DataLakeStore/accounts/read |
As edge source
As edge target
AuthenticatesToCanAdministerCanAttachIdentityCanControlCanCreateCanDeleteCanDeleteDataCanExfiltrateCanModifyCanModifyConfigurationCanModifyPolicyCanNetworkReachCanReachPortCanReadCanReadDataCanReplaceCanTakeOwnershipCanWriteCanWriteDataContainsContainsResourceReferenceControlsCredentialsForHasPermissionPrivateReachabilityExposure sites
aws-accessanalyzer-finding-details-metadataaws-appflow-flow-data-destinationaws-athena-query-result-rowsaws-backup-recovery-point-restored-contentaws-bedrock-runtime-prompt-response-payloadaws-cloudfront-key-value-store-valueaws-cloudtrail-event-data-store-query-resultsaws-cloudtrail-event-request-response-payload
Rules that touch DataLake 13
An LF admin (or GRANT OPTION holder) granting Lake Formation SELECT / INSERT / DATA_LOCATION_ACCESS to a principal ARN in a foreign AWS account creates cross- account data-lake trust: the external principal can query this account's governed data via their own analytics services.
lakeformation:GrantPermissions lets a principal grant LF data-lake permissions (SELECT / INSERT / DATA_LOCATION_ACCESS / etc.) to ANY principal, including themselves. This sub-rule captures the self-grant case (principal -> principal), the privilege escalation primitive in Lake Formation.
lakeformation:PutDataLakeSettings lets a principal add themselves to the Lake Formation DataLakeAdmins list, after which ALL LF permission checks are bypassed for that principal - they can grant any data permission to any principal, read any governed table, and modify any registered location. Emits CanGrantPermission (nature:both) to feed into can-control linchpin for escalation roll-up.
lakeformation:UpdateResource + iam:PassRole to lakeformation.amazonaws.com lets a principal swap the IAM role Lake Formation uses to vend temporary S3 credentials for a registered location, redirecting all subsequent data access through a role of the attacker's choosing.
Storage Blob Data Reader/Contributor/Owner grants effective data-plane read of ADLS Gen2 content.
azure
CanReadDataStorage Blob Data Contributor/Owner grants effective data-plane write of ADLS Gen2 content.
azure
CanWriteDatagenerateUserDelegationKey/action allows minting user-delegation SAS tokens (Token credential type) for external distribution.
azure
CanReadCredentiallistKeys/action returns ADLS Gen2 account keys, bypassing all RBAC and ACLs.
azure
CanReadCredentialAccount key (from listKeys) grants full data-plane read and SAS generation - enabling complete data exfiltration.
azure
CanExfiltrateADLS Gen2 account with public blob access enabled and a public container exposes blob data to unauthenticated internet access.
azure
ExposedToInternetModify code of a compute resource that runs as a privileged identity.
Change the execution identity binding of a compute resource to a chosen privileged identity.