contribution/cloud_storage.yml

name: Cloud Storage
definition: Data object storage infrastructure hosted on-premise or by third-party providers, made available to users through network connections and/or APIs
collection_layers:
  - Cloud Control Plane
platforms:
  - IaaS
contributors: 
  - ATT&CK
  - Center for Threat-Informed Defense (CTID)
data_components:
  - name: Cloud Storage Creation
    type: activity
    description: "Initial construction of new cloud storage infrastructure (ex: AWS S3 CreateBucket)"
    relationships:
      - source_data_element: user
        relationship: created
        target_data_element: cloud storage bucket
      - source_data_element: user
        relationship: created
        target_data_element: cloud storage object
  - name: Cloud Storage Modification
    type: activity
    description: "Changes made to cloud storage infrastructure, including its settings and/or data (ex: AWS S3 PutObject or PutObjectAcl)"
    relationships:
      - source_data_element: user
        relationship: modified
        target_data_element: cloud storage bucket
      - source_data_element: modified
        relationship: created
        target_data_element: cloud storage object
  - name: Cloud Storage Deletion
    type: activity
    description: "Removal of cloud storage infrastructure (ex: AWS S3 DeleteBucket)"
    relationships:
      - source_data_element: user
        relationship: deleted
        target_data_element: cloud storage bucket
      - source_data_element: user
        relationship: deleted
        target_data_element: cloud storage object
  - name: Cloud Storage Metadata
    type: information
    description: "Contextual data about cloud storage infrastructure and activity around it such as name, size, or owner"
    relationships:
      - source_data_element: user
        relationship: retrieved information about
        target_data_element: cloud storage
  - name: Cloud Storage Enumeration
    type: activity
    description: "An extracted list of cloud storage infrastructure (ex: AWS S3 ListBuckets or ListObjects)"
    relationships:
      - source_data_element: user
        relationship: listed
        target_data_element: cloud storage buckets
      - source_data_element: user
        relationship: listed
        target_data_element: cloud storage objects
  - name: Cloud Storage Access
    type: activity
    description: "Opening of a cloud storage infrastructure, typically to collect/read its value (ex: AWS S3 GetObject)"
    relationships:
      - source_data_element: user
        relationship: accessed
        target_data_element: cloud storage bucket
      - source_data_element: user
        relationship: accessed
        target_data_element: cloud storage object
references:
  - https://aws.amazon.com/s3/
  - https://azure.microsoft.com/en-us/services/storage/blobs/
  - https://cloud.google.com/storage