AWS Snapshot Made Public

AnalysisType: rule
Filename: aws_snapshot_made_public.py
RuleID: "AWS.CloudTrail.SnapshotMadePublic"
DisplayName: "AWS Snapshot Made Public"
Enabled: true
LogTypes:
  - AWS.CloudTrail
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0010:T1537

  Stratus Red Team:
    - aws.exfiltration.ec2-share-ebs-snapshot
Description: An AWS storage snapshot was made public.
Reference: 
  https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modifying-snapshot-permissions.html
Runbook: Adjust the snapshot configuration so that it is no longer public.
SummaryAttributes:
  - userAgent
  - sourceIpAddress
  - recipientAccountId
  - p_any_aws_arns
Tags:
  - AWS
  - Exfiltration:Transfer Data to Cloud Account
Tests:
  - Name: Snapshot Made Publicly Accessible
    ExpectedResult: true
    Log:
      {
        "awsRegion": "us-west-2",
        "eventID": "1111",
        "eventName": "ModifySnapshotAttribute",
        "eventSource": "ec2.amazonaws.com",
        "eventTime": "2019-01-01T00:00:00Z",
        "eventType": "AwsApiCall",
        "eventVersion": "1.05",
        "recipientAccountId": "123456789012",
        "requestID": "1111",
        "requestParameters": {
          "attributeType": "CREATE_VOLUME_PERMISSION",
          "createVolumePermission": {
            "add": {
              "items": [
                {
                  "group": "all"
                }
              ]
            }
          },
          "snapshotId": "snap-1111"
        },
        "responseElements": {
          "_return": true,
          "requestId": "1111"
        },
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "Mozilla/2.0 (compatible; NEWT ActiveX; Win32)",
        "userIdentity": {
          "accessKeyId": "1111",
          "accountId": "123456789012",
          "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-user",
          "principalId": "1111",
          "sessionContext": {
            "attributes": {
              "creationDate": "2019-01-01T00:00:00Z",
              "mfaAuthenticated": "true"
            },
            "sessionIssuer": {
              "accountId": "123456789012",
              "arn": "arn:aws:iam::123456789012:role/example-role",
              "principalId": "1111",
              "type": "Role",
              "userName": "example-role"
            },
            "webIdFederationData": {}
          },
          "type": "AssumedRole"
        }
      }
  - Name: Snapshot Not Made Publicly Accessible
    ExpectedResult: false
    Log:
      {
        "awsRegion": "us-west-2",
        "eventID": "1111",
        "eventName": "ModifySnapshotAttribute",
        "eventSource": "ec2.amazonaws.com",
        "eventTime": "2019-01-01T00:00:00Z",
        "eventType": "AwsApiCall",
        "eventVersion": "1.05",
        "recipientAccountId": "123456789012",
        "requestID": "1111",
        "requestParameters": {
          "attributeType": "CREATE_VOLUME_PERMISSION",
          "createVolumePermission": {
            "add": {
              "items": [
                {
                  "group": "none"
                }
              ]
            }
          },
          "snapshotId": "snap-1111"
        },
        "responseElements": {
          "_return": true,
          "requestId": "1111"
        },
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "Mozilla/2.0 (compatible; NEWT ActiveX; Win32)",
        "userIdentity": {
          "accessKeyId": "1111",
          "accountId": "123456789012",
          "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-user",
          "principalId": "1111",
          "sessionContext": {
            "attributes": {
              "creationDate": "2019-01-01T00:00:00Z",
              "mfaAuthenticated": "true"
            },
            "sessionIssuer": {
              "accountId": "123456789012",
              "arn": "arn:aws:iam::123456789012:role/example-role",
              "principalId": "1111",
              "type": "Role",
              "userName": "example-role"
            },
            "webIdFederationData": {}
          },
          "type": "AssumedRole"
        }
      }
  - Name: Error Making Snapshot Publicly Accessible
    ExpectedResult: false
    Log:
      {
        "awsRegion": "us-west-2",
        "errorCode": "ValidationError",
        "eventID": "1111",
        "eventName": "ModifySnapshotAttribute",
        "eventSource": "ec2.amazonaws.com",
        "eventTime": "2019-01-01T00:00:00Z",
        "eventType": "AwsApiCall",
        "eventVersion": "1.05",
        "recipientAccountId": "123456789012",
        "requestID": "1111",
        "requestParameters": {
          "attributeType": "CREATE_VOLUME_PERMISSION",
          "createVolumePermission": {
            "add": {
              "items": [
                {
                  "group": "all"
                }
              ]
            }
          },
          "snapshotId": "snap-1111"
        },
        "responseElements": {
          "_return": true,
          "requestId": "1111"
        },
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "Mozilla/2.0 (compatible; NEWT ActiveX; Win32)",
        "userIdentity": {
          "accessKeyId": "1111",
          "accountId": "123456789012",
          "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-user",
          "principalId": "1111",
          "sessionContext": {
            "attributes": {
              "creationDate": "2019-01-01T00:00:00Z",
              "mfaAuthenticated": "true"
            },
            "sessionIssuer": {
              "accountId": "123456789012",
              "arn": "arn:aws:iam::123456789012:role/example-role",
              "principalId": "1111",
              "type": "Role",
              "userName": "example-role"
            },
            "webIdFederationData": {}
          },
          "type": "AssumedRole"
        }
      }
  - Name: Snapshot Mader Available to Single Person
    ExpectedResult: true
    Log:
      {
        "awsRegion": "us-west-2",
        "eventID": "1111",
        "eventName": "ModifySnapshotAttribute",
        "eventSource": "ec2.amazonaws.com",
        "eventTime": "2019-01-01T00:00:00Z",
        "eventType": "AwsApiCall",
        "eventVersion": "1.05",
        "recipientAccountId": "123456789012",
        "requestID": "1111",
        "requestParameters": {
          "attributeType": "CREATE_VOLUME_PERMISSION",
          "createVolumePermission": {
            "add": {
              "items": [
                {
                  "userId": "111122223333"
                }
              ]
            }
          },
          "snapshotId": "snap-1111"
        },
        "responseElements": {
          "_return": true,
          "requestId": "1111"
        },
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "Mozilla/2.0 (compatible; NEWT ActiveX; Win32)",
        "userIdentity": {
          "accessKeyId": "1111",
          "accountId": "123456789012",
          "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-user",
          "principalId": "1111",
          "sessionContext": {
            "attributes": {
              "creationDate": "2019-01-01T00:00:00Z",
              "mfaAuthenticated": "true"
            },
            "sessionIssuer": {
              "accountId": "123456789012",
              "arn": "arn:aws:iam::123456789012:role/example-role",
              "principalId": "1111",
              "type": "Role",
              "userName": "example-role"
            },
            "webIdFederationData": {}
          },
          "type": "AssumedRole"
        }
      }


# ------ paired body: aws_snapshot_made_public.py ------

from collections.abc import Mapping

from panther_aws_helpers import aws_cloudtrail_success, aws_rule_context
from panther_base_helpers import deep_get

IS_SINGLE_USER_SHARE = False  # Used to adjust severity


def rule(event):
    if not aws_cloudtrail_success(event):
        return False

    # EC2 Volume snapshot made public
    if event.get("eventName") == "ModifySnapshotAttribute":
        parameters = event.get("requestParameters", {})
        if parameters.get("attributeType") != "CREATE_VOLUME_PERMISSION":
            return False

        items = deep_get(parameters, "createVolumePermission", "add", "items", default=[])
        for item in items:
            if not isinstance(item, (Mapping, dict)):
                continue
            if item.get("userId") or item.get("group") == "all":
                global IS_SINGLE_USER_SHARE  # pylint: disable=global-statement
                IS_SINGLE_USER_SHARE = "userId" in item  # Used for dynamic severity
                return True
        return False

    return False


def severity(_):
    # Set severity to INFO if only shared with a single user
    if IS_SINGLE_USER_SHARE:
        return "INFO"
    return "DEFAULT"


def alert_context(event):
    return aws_rule_context(event)