aws-documentdb-public-cluster

A DocumentDB cluster with PubliclyAccessible=true and a VPC security group permitting inbound TCP 27017 from 0.0.0.0/0 or ::/0 is network-reachable from the public internet. Valid MongoDB credentials (obtained via credential-grab paths) enable connection without VPC foothold.

derived aws emits ExposedToInternet

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`NoSQLDatabase`
target type	`AnonymousIdentity`
source	`?cluster`
target	`<AnonymousIdentity>`
conditions	`iam_permission` `network_reachability`
state logic	ACTIVE when both PubliclyAccessible=true AND an inbound SG rule allows port 27017 from 0.0.0.0/0 or ::/0 (network-reachable from the internet). Derive the state from the cluster's configuration + SG attachment (both must be confirmed). CONDITIONAL(network_reachability) if PubliclyAccessible=true but the SG blocks port 27017 or restricts it to specific CIDRs (not internet-open). BLOCKED if an organizational SCP or service control policy restricts public exposure.

source type

NoSQLDatabase

target type

AnonymousIdentity

source

?cluster

target

<AnonymousIdentity>

conditions

iam_permission network_reachability

state logic

ACTIVE when both PubliclyAccessible=true AND an inbound SG rule allows port 27017 from 0.0.0.0/0 or ::/0 (network-reachable from the internet). Derive the state from the cluster's configuration + SG attachment (both must be confirmed). CONDITIONAL(network_reachability) if PubliclyAccessible=true but the SG blocks port 27017 or restricts it to specific CIDRs (not internet-open). BLOCKED if an organizational SCP or service control policy restricts public exposure.

Narrative

{cluster.name} is reachable from the public internet (PubliclyAccessible=true and VPC security group allows inbound on port 27017 from 0.0.0.0/0). An attacker with valid MongoDB credentials can connect without needing a VPC foothold.

Raw rule rules/derived/aws/documentdb.yaml

id: aws-documentdb-public-cluster
emits: ExposedToInternet
description: A DocumentDB cluster with PubliclyAccessible=true and a VPC security group permitting inbound
  TCP 27017 from 0.0.0.0/0 or ::/0 is network-reachable from the public internet. Valid MongoDB credentials
  (obtained via credential-grab paths) enable connection without VPC foothold.
match:
- - cluster: null
  - AttachedTo
  - sg: null
where:
- node_type(?cluster) == NoSQLDatabase
- ?cluster.provider_type == 'AWS::DocDB::DBCluster'
- ?cluster.properties.PubliclyAccessible == true
- ?sg allows inbound TCP 27017 from 0.0.0.0/0 or ::/0
emit:
  source_type: NoSQLDatabase
  target_type: AnonymousIdentity
  source: ?cluster
  target: <AnonymousIdentity>
  permissions: []
  conditions:
  - iam_permission
  - network_reachability
  state_logic: ACTIVE when both PubliclyAccessible=true AND an inbound SG rule allows port 27017 from
    0.0.0.0/0 or ::/0 (network-reachable from the internet). Derive the state from the cluster's configuration
    + SG attachment (both must be confirmed). CONDITIONAL(network_reachability) if PubliclyAccessible=true
    but the SG blocks port 27017 or restricts it to specific CIDRs (not internet-open). BLOCKED if an
    organizational SCP or service control policy restricts public exposure.
  confidence: '1.0'
  derived_from:
  - ?cluster PubliclyAccessible=true (from rds:DescribeDBClusters)
  - ?cluster attached SG allows inbound TCP 27017 from 0.0.0.0/0 or ::/0 (from ec2:DescribeSecurityGroups)
  false_positive_note: "Two independent data sources MUST both confirm: (1) PubliclyAccessible must equal\
    \ true on the cluster resource. (2) The cluster's attached security group must have an inbound rule\
    \ allowing 0.0.0.0/0 (or ::/0 for IPv6) on TCP 27017. A cluster with PubliclyAccessible=true but a\
    \ restrictive SG (port 27017 closed or open only to specific CIDRs like corporate office IPs) is NOT\
    \ ExposedToInternet. Valid MongoDB credentials are still required \u2014 this edge represents network\
    \ reach only, not authentication. Combine with credential-grab attack paths (master creds via Secrets\
    \ Manager, password reset via rds:ModifyDBCluster) to model full data access. Mirror aws-rds-public-instance\
    \ pattern: both check PubliclyAccessible + SG port rule and emit to AnonymousIdentity."
  narrative: '{cluster.name} is reachable from the public internet (PubliclyAccessible=true and VPC security
    group allows inbound on port 27017 from 0.0.0.0/0). An attacker with valid MongoDB credentials can
    connect without needing a VPC foothold.'