aws-documentdb-read-data-via-master-creds

id: aws-documentdb-read-data-via-master-creds
emits: CanReadData
description: A principal that can read the DocumentDB master-password secret from Secrets Manager can
  authenticate to the cluster as the master MongoDB user, gaining full data-plane access (read/write/drop)
  across all databases on the cluster.
match:
- - cluster: null
  - ContainsSecret
  - secret: null
- - principal: null
  - CanReadSecret
  - secret: null
where:
- node_type(?cluster) == NoSQLDatabase
- ?cluster.provider_type == 'AWS::DocDB::DBCluster'
- node_type(?secret) == Secret
- ?secret.source_field == 'MasterUserSecret.SecretArn'
emit:
  source_type: Identity
  target_type: NoSQLDatabase
  source: ?principal
  target: ?cluster
  permissions:
  - secretsmanager:GetSecretValue
  conditions:
  - iam_permission
  - resource_policy
  - key_permission
  - network_reachability
  state_logic: "Inherit weakest state from the two contributing edges. If CanReadSecret is CONDITIONAL(key_permission)\
    \ (Secrets Manager secret encrypted with a CMK the principal cannot decrypt), emit CONDITIONAL(key_permission).\
    \ If CanReadSecret is ACTIVE and the cluster is NOT PubliclyAccessible (private VPC only), emit CONDITIONAL(network_reachability)\
    \ \u2014 the principal must have a network path to port 27017 on the cluster endpoint. If CanReadSecret\
    \ is ACTIVE and the cluster is PubliclyAccessible=true with a permissive SG, emit ACTIVE \u2014 credentials\
    \ are sufficient for data-plane access. BLOCKED when the contributing CanReadSecret is BLOCKED (explicit\
    \ deny on secretsmanager:GetSecretValue via SCP, resource policy, or KMS deny). Note: DocumentDB has\
    \ no IAM-native data-plane API; this edge is gated on the MongoDB wire-protocol connection being network-reachable.\
    \ The credential-chain roll-up (CanImpersonate/CanEscalateTo) is owned by credential-chains:read-secret-yields-identity\
    \ \u2014 cite, do not re-derive."
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - ?cluster ContainsSecret ?secret (MasterUserSecret.SecretArn)
  - ?principal CanReadSecret ?secret (secretsmanager:GetSecretValue)
  - "credential-chains:read-secret-yields-identity (CanImpersonate roll-up \u2014 cited not re-derived)"
  false_positive_note: "Three independent conditions must hold: (1) the cluster uses ManageMasterUserPassword=true\
    \ so the secret exists and is populated; for caller-supplied passwords there is no Secrets Manager\
    \ link and ContainsSecret is not emitted -> this rule does not fire. (2) The principal has EFFECTIVE\
    \ secretsmanager:GetSecretValue on the specific secret ARN \u2014 honor KMS encryption of the secret\
    \ (CONDITIONAL(key_permission) if the secret is wrapped with a CMK the principal cannot decrypt; cite\
    \ credential-chains:decrypt-gates-secret-read for the gate resolution). (3) The cluster endpoint must\
    \ be network-reachable (private VPC by default) \u2014 emit CONDITIONAL(network_reachability) unless\
    \ PubliclyAccessible=true + SG open on port 27017. Do NOT emit ACTIVE when network reachability is\
    \ unresolved. The master-user account has full MongoDB admin rights; if the cluster's IAM condition\
    \ restricts the secret to specific principals, honor it."
  narrative: "{principal.name} can read the DocumentDB master-password secret {secret.name} from Secrets\
    \ Manager (secretsmanager:GetSecretValue), obtaining the MongoDB admin username and password for cluster\
    \ {cluster.name}; possessing these credentials grants full data-plane access \u2014 read, write, and\
    \ drop \u2014 across all databases on the cluster."