aws-documentdb-modify-cluster-resets-password

id: aws-documentdb-modify-cluster-resets-password
emits: CanReadData
description: "rds:ModifyDBCluster with MasterUserPassword resets the cluster's master password to an attacker-known\
  \ value, granting superuser MongoDB access without knowing the current password \u2014 a single control-plane\
  \ escalation primitive."
match:
- - principal: null
  - CanModifyConfiguration
  - cluster: null
where:
- node_type(?cluster) == NoSQLDatabase
- ?cluster.provider_type == 'AWS::DocDB::DBCluster'
- ?principal has EFFECTIVE rds:ModifyDBCluster on ?cluster ARN
emit:
  source_type: Identity
  target_type: NoSQLDatabase
  source: ?principal
  target: ?cluster
  permissions:
  - rds:ModifyDBCluster
  conditions:
  - iam_permission
  - scp_or_org_policy
  - service_state
  - network_reachability
  state_logic: "ACTIVE when rds:ModifyDBCluster is confirmed EFFECTIVE on the cluster ARN, the cluster\
    \ is PubliclyAccessible=true with a permissive SG allowing inbound TCP 27017 from the attacker's network\
    \ position, and the cluster is in AVAILABLE state. The password reset itself is a control-plane action\
    \ (succeeds regardless of network), but completing data-plane MongoDB access requires network reachability\
    \ on port 27017. CONDITIONAL(network_reachability) when rds:ModifyDBCluster is EFFECTIVE but the cluster\
    \ is NOT PubliclyAccessible (private VPC only) \u2014 the attacker must have a network path to port\
    \ 27017 on the cluster endpoint (e.g., VPC foothold, VPN, or proximity to the private subnet) to connect\
    \ after resetting the password. CONDITIONAL(service_state) when the cluster is not in AVAILABLE state\
    \ (CREATING, MODIFYING, STOPPING) \u2014 ModifyDBCluster is accepted but may be deferred to the next\
    \ maintenance window. Emit ACTIVE if AVAILABLE; emit CONDITIONAL(service_state) if deferred. BLOCKED\
    \ when an SCP or permission boundary explicitly denies rds:ModifyDBCluster on the cluster."
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - ?principal CanModifyConfiguration ?cluster (rds:ModifyDBCluster effective permission)
  false_positive_note: "This rule emits CanReadData because resetting the master password IS gaining data\
    \ access \u2014 after the reset the attacker connects as superuser. However, it is a DESTRUCTIVE mutation:\
    \ it disrupts legitimate master-user access and is highly detectable in CloudTrail (ModifyDBCluster\
    \ call + MasterUserPassword change). This pattern mirrors aws-rds-modify-instance-resets-password\
    \ for RDS. The cluster must be AVAILABLE (not STOPPED, CREATING, or in MODIFYING state for another\
    \ operation) for the modification to proceed immediately; a STOPPED cluster may still accept the modify\
    \ call (state_logic: defer to maintenance window \u2014 emit ACTIVE and note the deferral). Do NOT\
    \ downgrade to CONDITIONAL for this case unless an explicit IAM condition blocks MasterUserPassword\
    \ changes (uncommon on DocumentDB). Network reachability is needed for data-plane access (MongoDB\
    \ connection) but the password reset itself is a control-plane capability (does not require VPC foothold)."
  narrative: '{principal.name} can reset the master DB password for the DocumentDB cluster {cluster.name}
    (rds:ModifyDBCluster) without knowing the current password, then connect as the database superuser
    to read, modify, or drop all MongoDB documents. This is the highest-value single-permission DocumentDB
    escalation primitive.'