aws-documentdb-snapshot-exfiltration-capability

rds:ModifyDBClusterSnapshotAttribute allows a principal to make a DocumentDB cluster snapshot shareable (publicly if ValuesToAdd=['all'], or to a specific account if ValuesToAdd=[<account-id>]). Any restoring account can then call rds:RestoreDBClusterFromSnapshot to exfiltrate a full database copy.

derived aws emits CanExfiltrate

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'snapshot': None}

where

node_type(?snapshot) == Snapshot ?snapshot.provider_type == 'AWS::DocDB::DBClusterSnapshot' ?principal has EFFECTIVE rds:ModifyDBClusterSnapshotAttribute on ?snapshot ARN

emit

source type	`Identity`
target type	`Snapshot`
source	`?principal`
target	`?snapshot`
permissions	`rds:ModifyDBClusterSnapshotAttribute`
conditions	`iam_permission` `scp_or_org_policy` `key_permission`
state logic	ACTIVE when rds:ModifyDBClusterSnapshotAttribute is confirmed EFFECTIVE on the snapshot ARN — identity-based policy, no SCP deny, no permission boundary block. The attacker's CAPABILITY to SHARE the snapshot (emit CanExfiltrate as ACTIVE) is unconditional. CONDITIONAL(key_permission) when the snapshot is encrypted with a CMK: any account attempting to restore the shared snapshot must also be granted kms:Decrypt on the CMK — without that, the restore fails in the restoring account. However, this gates the RESTORER, not the SHARER. Emit ACTIVE for the sharing capability; note the CMK key-grant requirement as a downstream gate on the restoring account. BLOCKED when an SCP or permission boundary denies rds:ModifyDBClusterSnapshotAttribute. Org-level SCP disallowing snapshot sharing would block this — emit BLOCKED when confirmed.

Narrative

{principal.name} can make the DocumentDB cluster snapshot {snapshot.name} shareable (rds:ModifyDBClusterSnapshotAttribute), enabling target account(s) to restore a full copy of all cluster documents - data exfiltration without network access to the live cluster.

Raw rule rules/derived/aws/documentdb.yaml

id: aws-documentdb-snapshot-exfiltration-capability
emits: CanExfiltrate
description: rds:ModifyDBClusterSnapshotAttribute allows a principal to make a DocumentDB cluster snapshot
  shareable (publicly if ValuesToAdd=['all'], or to a specific account if ValuesToAdd=[<account-id>]).
  Any restoring account can then call rds:RestoreDBClusterFromSnapshot to exfiltrate a full database copy.
match:
- - principal: null
  - HasPermission
  - snapshot: null
where:
- node_type(?snapshot) == Snapshot
- ?snapshot.provider_type == 'AWS::DocDB::DBClusterSnapshot'
- ?principal has EFFECTIVE rds:ModifyDBClusterSnapshotAttribute on ?snapshot ARN
emit:
  source_type: Identity
  target_type: Snapshot
  source: ?principal
  target: ?snapshot
  permissions:
  - rds:ModifyDBClusterSnapshotAttribute
  conditions:
  - iam_permission
  - scp_or_org_policy
  - key_permission
  state_logic: "ACTIVE when rds:ModifyDBClusterSnapshotAttribute is confirmed EFFECTIVE on the snapshot\
    \ ARN \u2014 identity-based policy, no SCP deny, no permission boundary block. The attacker's CAPABILITY\
    \ to SHARE the snapshot (emit CanExfiltrate as ACTIVE) is unconditional. CONDITIONAL(key_permission)\
    \ when the snapshot is encrypted with a CMK: any account attempting to restore the shared snapshot\
    \ must also be granted kms:Decrypt on the CMK \u2014 without that, the restore fails in the restoring\
    \ account. However, this gates the RESTORER, not the SHARER. Emit ACTIVE for the sharing capability;\
    \ note the CMK key-grant requirement as a downstream gate on the restoring account. BLOCKED when an\
    \ SCP or permission boundary denies rds:ModifyDBClusterSnapshotAttribute. Org-level SCP disallowing\
    \ snapshot sharing would block this \u2014 emit BLOCKED when confirmed."
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - ?principal HasPermission ?snapshot (rds:ModifyDBClusterSnapshotAttribute effective permission)
  false_positive_note: "The attacker need only have rds:ModifyDBClusterSnapshotAttribute on the snapshot\
    \ ARN. The rule fires regardless of whether the share target is 'all' (public) or a specific account\
    \ ID (targeted) \u2014 both are CanExfiltrate from the sharer's perspective. Restore is performed\
    \ by the external account, so CanExfiltrate models the AUTHORIZATION CAPABILITY, not the completed\
    \ restore. Public snapshots without CMK encryption (default AES-256 AWS-managed encryption) are transparent\
    \ to the restoring account \u2014 only CMK-encrypted snapshots require a cross-account key grant.\
    \ Score CMK-encrypted snapshots as CONDITIONAL(key_permission) for the restoring account, but ACTIVE\
    \ for the sharing step itself. The blast radius distinction (public vs. targeted) is captured by the\
    \ evidence trail (public snapshots \u2192 ExposedToInternet via aws-documentdb-snapshot-public-exposed;\
    \ targeted snapshots \u2192 CrossAccountTrust via aws-documentdb-snapshot-cross-account-trust)."
  narrative: "{principal.name} can make the DocumentDB cluster snapshot {snapshot.name} shareable (rds:ModifyDBClusterSnapshotAttribute),\
    \ enabling target account(s) to restore a full copy of all cluster documents \u2014 data exfiltration\
    \ without network access to the live cluster."