aws-documentdb-contains-master-secret
DocumentDB cluster stores its master MongoDB user password in a Secrets Manager secret when ManageMasterUserPassword is enabled.
match (record)
{
"field": "MasterUserSecret.SecretArn",
"resource_type": "AWS::DocDB::DBCluster"
}
emit
| source type | NoSQLDatabase |
|---|---|
| target type | Secret |
| source | <DocumentDB cluster (NoSQLDatabase)> |
| target | <Secrets Manager secret at MasterUserSecret.SecretArn> |
Narrative
{cluster.name} stores its master MongoDB password in Secrets Manager secret {secret.name} (ManageMasterUserPassword integration). Reading this secret yields full MongoDB admin credentials for the cluster.
Raw rule rules/explicit/aws-documentdb.yaml
id: aws-documentdb-contains-master-secret
emits: ContainsSecret
applies_to:
- aws
description: DocumentDB cluster stores its master MongoDB user password in a Secrets Manager secret when
ManageMasterUserPassword is enabled.
match_record:
resource_type: AWS::DocDB::DBCluster
field: MasterUserSecret.SecretArn
emit:
source_type: NoSQLDatabase
target_type: Secret
source: <DocumentDB cluster (NoSQLDatabase)>
target: <Secrets Manager secret at MasterUserSecret.SecretArn>
api_source: rds:DescribeDBClusters
evidence_field: DBClusters[].MasterUserSecret.SecretArn
narrative: '{cluster.name} stores its master MongoDB password in Secrets Manager secret {secret.name}
(ManageMasterUserPassword integration). Reading this secret yields full MongoDB admin credentials
for the cluster.'