aws-documentdb-copy-snapshot-to-share

id: aws-documentdb-copy-snapshot-to-share
emits: CanExfiltrate
description: 'rds:CopyDBClusterSnapshot + rds:ModifyDBClusterSnapshotAttribute together enable exfiltration
  of automated DocumentDB cluster snapshots: copy an automated snapshot to manual, then share the manual
  copy cross-account or publicly.'
match:
- - principal: null
  - HasPermission
  - cluster: null
where:
- node_type(?cluster) == NoSQLDatabase
- ?cluster.provider_type == 'AWS::DocDB::DBCluster'
- ?cluster has automated backups enabled (BackupRetentionPeriod > 0)
- ?principal has EFFECTIVE rds:CopyDBClusterSnapshot on the cluster's automated snapshots
- ?principal has EFFECTIVE rds:ModifyDBClusterSnapshotAttribute on snapshot ARNs
emit:
  source_type: Identity
  target_type: NoSQLDatabase
  source: ?principal
  target: ?cluster
  permissions:
  - rds:CopyDBClusterSnapshot
  - rds:ModifyDBClusterSnapshotAttribute
  conditions:
  - iam_permission
  - scp_or_org_policy
  - service_state
  state_logic: CONDITIONAL(service_state) when the principal has EFFECTIVE rds:CopyDBClusterSnapshot and
    rds:ModifyDBClusterSnapshotAttribute, AND the cluster has automated backups enabled (BackupRetentionPeriod
    > 0). The prerequisite (automated snapshot exists) is satisfied by the backup retention setting. The
    two-step operation (copy then modify) is required; a single permission does not enable exfil. Emit
    CONDITIONAL to model the multi-step capability. BLOCKED when an SCP or permission boundary denies
    either rds:CopyDBClusterSnapshot or rds:ModifyDBClusterSnapshotAttribute.
  confidence: min(contributing_confidences) * 0.85
  derived_from:
  - ?principal HasPermission (rds:CopyDBClusterSnapshot + rds:ModifyDBClusterSnapshotAttribute)
  - ?cluster automated backups enabled (BackupRetentionPeriod > 0)
  false_positive_note: 'Both permissions must be present on the principal. The cluster must have automated
    backups enabled (BackupRetentionPeriod > 0). The capability is a two-step operation: (1) copy an automated
    snapshot to manual via rds:CopyDBClusterSnapshot, (2) share the manual copy via rds:ModifyDBClusterSnapshotAttribute.
    Emit to the cluster (source of data), not the snapshot, since the manual snapshot doesn''t exist until
    the copy completes. This rule bridges the gap noted in the BLOCKED-edge guidance: automated snapshots
    cannot be directly shared, but the copy+share combo enables exfiltration and should be modeled as
    a CanExfiltrate capability.'
  narrative: '{principal.name} can copy an automated DocumentDB backup snapshot to a manual snapshot (rds:CopyDBClusterSnapshot)
    and then share it cross-account or publicly (rds:ModifyDBClusterSnapshotAttribute), enabling exfiltration
    of all cluster data via a two-step process.'