aws-documentdb-can-modify-cluster
Principal with rds:ModifyDBCluster on the cluster resource ARN can modify cluster configuration, including resetting the master user password without knowing the current password.
match (effective permission)
{
"action": "rds:ModifyDBCluster",
"resource_type": "AWS::DocDB::DBCluster"
}
emit
| source type | Identity |
|---|---|
| target type | NoSQLDatabase |
| source | <principal> |
| target | <DocumentDB cluster (NoSQLDatabase)> |
| permissions | rds:ModifyDBCluster |
Narrative
{principal.name} can modify DocumentDB cluster {cluster.name} configuration via rds:ModifyDBCluster, including resetting the master user password to an attacker-known value, granting superuser MongoDB access without knowing the current password.
Raw rule rules/explicit/aws-documentdb.yaml
id: aws-documentdb-can-modify-cluster
emits: CanModifyConfiguration
applies_to:
- aws
description: Principal with rds:ModifyDBCluster on the cluster resource ARN can modify cluster configuration,
including resetting the master user password without knowing the current password.
match_effective_permission:
action: rds:ModifyDBCluster
resource_type: AWS::DocDB::DBCluster
emit:
source_type: Identity
target_type: NoSQLDatabase
source: <principal>
target: <DocumentDB cluster (NoSQLDatabase)>
permissions:
- rds:ModifyDBCluster
narrative: '{principal.name} can modify DocumentDB cluster {cluster.name} configuration via rds:ModifyDBCluster,
including resetting the master user password to an attacker-known value, granting superuser MongoDB
access without knowing the current password.'