aws-documentdb-snapshot-restore-yields-data

A principal in the snapshot's restore-authorized account with rds:RestoreDBClusterFromSnapshot can restore a shared DocumentDB cluster snapshot to a new cluster, obtaining full read access to all original data without network access to the source cluster.

derived aws emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'snapshot': None} CrossAccountTrust {'account': None} {'principal': None} CanModifyConfiguration {'cluster': None}

where

node_type(?snapshot) == Snapshot ?snapshot.provider_type == 'AWS::DocDB::DBClusterSnapshot' node_type(?account) == Account ?principal's home account == ?account ?principal has EFFECTIVE rds:RestoreDBClusterFromSnapshot on ?snapshot ARN

emit

source type	`Identity`
target type	`Snapshot`
source	`?principal`
target	`?snapshot`
permissions	`rds:RestoreDBClusterFromSnapshot`
conditions	`iam_permission` `scp_or_org_policy` `service_state`
state logic	CONDITIONAL(service_state) when the principal has EFFECTIVE rds:RestoreDBClusterFromSnapshot and the snapshot's restore-authorized account matches the principal's home account. The restore must actually be executed to read data; the snapshot is not live data until restored. Emit CONDITIONAL(service_state) to model the capability to perform the restore (not yet realized until the attacker runs RestoreDBClusterFromSnapshot). ACTIVE only if evidence shows a restore has already been executed (the restored cluster exists and is AVAILABLE). BLOCKED when an SCP or permission boundary denies rds:RestoreDBClusterFromSnapshot on the target cluster.

Narrative

{principal.name} in account {account.id} can restore the DocumentDB cluster snapshot {snapshot.name} (rds:RestoreDBClusterFromSnapshot), creating a new cluster with access to all original cluster documents. This completes the snapshot exfiltration path: the snapshot is shared cross-account, then restored to the attacker's account for full data read access.

Raw rule rules/derived/aws/documentdb.yaml

id: aws-documentdb-snapshot-restore-yields-data
emits: CanReadData
description: A principal in the snapshot's restore-authorized account with rds:RestoreDBClusterFromSnapshot
  can restore a shared DocumentDB cluster snapshot to a new cluster, obtaining full read access to all
  original data without network access to the source cluster.
match:
- - snapshot: null
  - CrossAccountTrust
  - account: null
- - principal: null
  - CanModifyConfiguration
  - cluster: null
where:
- node_type(?snapshot) == Snapshot
- ?snapshot.provider_type == 'AWS::DocDB::DBClusterSnapshot'
- node_type(?account) == Account
- ?principal's home account == ?account
- ?principal has EFFECTIVE rds:RestoreDBClusterFromSnapshot on ?snapshot ARN
emit:
  source_type: Identity
  target_type: Snapshot
  source: ?principal
  target: ?snapshot
  permissions:
  - rds:RestoreDBClusterFromSnapshot
  conditions:
  - iam_permission
  - scp_or_org_policy
  - service_state
  state_logic: CONDITIONAL(service_state) when the principal has EFFECTIVE rds:RestoreDBClusterFromSnapshot
    and the snapshot's restore-authorized account matches the principal's home account. The restore must
    actually be executed to read data; the snapshot is not live data until restored. Emit CONDITIONAL(service_state)
    to model the capability to perform the restore (not yet realized until the attacker runs RestoreDBClusterFromSnapshot).
    ACTIVE only if evidence shows a restore has already been executed (the restored cluster exists and
    is AVAILABLE). BLOCKED when an SCP or permission boundary denies rds:RestoreDBClusterFromSnapshot
    on the target cluster.
  confidence: min(contributing_confidences) * 0.85
  derived_from:
  - ?snapshot CrossAccountTrust ?account (explicit from aws-documentdb-snapshot-cross-account-trust)
  - ?principal CanModifyConfiguration (rds:RestoreDBClusterFromSnapshot effective permission)
  false_positive_note: The principal must be in the receiving account (CrossAccountTrust target account).
    The snapshot must be shared (CrossAccountTrust edge present). The principal must have rds:RestoreDBClusterFromSnapshot
    on the snapshot ARN or cluster resource. The restore operation creates a new cluster resource that
    the attacker controls; model the target as the Snapshot node (source of data) since the new cluster
    doesn't exist until the restore completes. CONDITIONAL(service_state) reflects that the restore must
    be triggered, not that permissions exist statically.
  narrative: '{principal.name} in account {account.id} can restore the DocumentDB cluster snapshot {snapshot.name}
    (rds:RestoreDBClusterFromSnapshot), creating a new cluster with access to all original cluster documents.
    This completes the snapshot exfiltration path: the snapshot is shared cross-account, then restored
    to the attacker''s account for full data read access.'