aws-documentdb-snapshot-public-exposed
DocumentDB cluster snapshot is publicly restorable (restore attribute contains 'all') via rds:DescribeDBClusterSnapshotAttributes.
match (record)
{
"field": "DBClusterSnapshotAttributes[restore].AttributeValues",
"resource_type": "AWS::DocDB::DBClusterSnapshot"
}
where
AttributeValues contains 'all'
emit
| source type | Snapshot |
|---|---|
| target type | AnonymousIdentity |
| source | <DocumentDB cluster snapshot (Snapshot)> |
| target | <AnonymousIdentity> |
Narrative
DocumentDB cluster snapshot {snapshot.name} is publicly restorable (AttributeValues contains 'all') - any AWS account can call rds:RestoreDBClusterFromSnapshot to create a full copy of all cluster data without the owner's involvement (complete data exfiltration).
Raw rule rules/explicit/aws-documentdb.yaml
id: aws-documentdb-snapshot-public-exposed
emits: ExposedToInternet
applies_to:
- aws
description: DocumentDB cluster snapshot is publicly restorable (restore attribute contains 'all') via
rds:DescribeDBClusterSnapshotAttributes.
match_record:
resource_type: AWS::DocDB::DBClusterSnapshot
field: DBClusterSnapshotAttributes[restore].AttributeValues
where:
- AttributeValues contains 'all'
emit:
source_type: Snapshot
target_type: AnonymousIdentity
source: <DocumentDB cluster snapshot (Snapshot)>
target: <AnonymousIdentity>
api_source: rds:DescribeDBClusterSnapshotAttributes
evidence_field: DBClusterSnapshotAttributes[restore].AttributeValues == 'all'
narrative: "DocumentDB cluster snapshot {snapshot.name} is publicly restorable (AttributeValues contains\
\ 'all') \u2014 any AWS account can call rds:RestoreDBClusterFromSnapshot to create a full copy of\
\ all cluster data without the owner's involvement (complete data exfiltration)."