aws-dynamodb-read-data

dynamodb:GetItem / Query / Scan grants item-level read access to the table, including any secrets or sensitive data stored as item attributes.

derived aws emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'table': None}

where

node_type(?table) == NoSQLDatabase ?table.provider_type in ['AWS::DynamoDB::Table', 'AWS::DynamoDB::GlobalTable'] ?principal has EFFECTIVE at least ONE of: dynamodb:GetItem, dynamodb:Query, dynamodb:Scan on ?table ARN

emit

source type	`Identity`
target type	`NoSQLDatabase`
source	`?principal`
target	`?table`
permissions	`dynamodb:GetItem` `dynamodb:Query` `dynamodb:Scan`
conditions	`iam_permission` `resource_policy` `key_permission`
state logic	ACTIVE when at least one of dynamodb:GetItem, dynamodb:Query, or dynamodb:Scan is confirmed EFFECTIVE on the table ARN (identity-based policy + resource policy evaluated + no SCP deny) AND the table's SSE uses the AWS-managed default key (alias/aws/dynamodb) or no SSE. CONDITIONAL(key_permission) when the table uses SSE with a customer-managed CMK (SSEDescription.KMSMasterKeyArn present and not the default alias) — decrypt requires kms:Decrypt on that CMK; the credential-chains:decrypt-gates-secret-read linchpin upgrades this when the principal also holds CanDecrypt on the wrapping key. CONDITIONAL(resource_policy) when a table resource policy exists but the evaluation of the principal's access through it is unresolved. BLOCKED by an explicit SCP or permission-boundary deny on all three read actions simultaneously. IAM condition keys dynamodb:LeadingKeys and dynamodb:Attributes narrow access to specific items/attributes — CONDITIONAL(condition_expression) when such conditions are present and the accessible data scope is unclear.

Narrative

{principal.name} can read items from DynamoDB table {table.name} via GetItem, Query, or Scan (dynamodb:GetItem / Query / Scan), accessing all attribute data the table contains - including any secrets, credentials, or application-sensitive data stored as item attributes.

Raw rule rules/derived/aws/dynamodb.yaml

id: aws-dynamodb-read-data
emits: CanReadData
description: dynamodb:GetItem / Query / Scan grants item-level read access to the table, including any
  secrets or sensitive data stored as item attributes.
match:
- - principal: null
  - HasPermission
  - table: null
where:
- node_type(?table) == NoSQLDatabase
- ?table.provider_type in ['AWS::DynamoDB::Table', 'AWS::DynamoDB::GlobalTable']
- '?principal has EFFECTIVE at least ONE of: dynamodb:GetItem, dynamodb:Query, dynamodb:Scan on ?table
  ARN'
emit:
  source_type: Identity
  target_type: NoSQLDatabase
  source: ?principal
  target: ?table
  permissions:
  - dynamodb:GetItem
  - dynamodb:Query
  - dynamodb:Scan
  conditions:
  - iam_permission
  - resource_policy
  - key_permission
  state_logic: "ACTIVE when at least one of dynamodb:GetItem, dynamodb:Query, or dynamodb:Scan is confirmed\
    \ EFFECTIVE on the table ARN (identity-based policy + resource policy evaluated + no SCP deny) AND\
    \ the table's SSE uses the AWS-managed default key (alias/aws/dynamodb) or no SSE. CONDITIONAL(key_permission)\
    \ when the table uses SSE with a customer-managed CMK (SSEDescription.KMSMasterKeyArn present and\
    \ not the default alias) \u2014 decrypt requires kms:Decrypt on that CMK; the credential-chains:decrypt-gates-secret-read\
    \ linchpin upgrades this when the principal also holds CanDecrypt on the wrapping key. CONDITIONAL(resource_policy)\
    \ when a table resource policy exists but the evaluation of the principal's access through it is unresolved.\
    \ BLOCKED by an explicit SCP or permission-boundary deny on all three read actions simultaneously.\
    \ IAM condition keys dynamodb:LeadingKeys and dynamodb:Attributes narrow access to specific items/attributes\
    \ \u2014 CONDITIONAL(condition_expression) when such conditions are present and the accessible data\
    \ scope is unclear."
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - ?principal HasPermission ?table (dynamodb:GetItem / Query / Scan effective permission)
  false_positive_note: "At least ONE of the three read actions must be effective; all three being denied\
    \ yields no read capability. IAM condition key dynamodb:LeadingKeys (partition-key scoping) or dynamodb:Attributes\
    \ (attribute-level projection) can restrict the accessible item set significantly \u2014 downgrade\
    \ confidence and note CONDITIONAL(condition_expression) when these conditions are present with non-trivial\
    \ values. A table with SSE using a customer-managed CMK (not alias/aws/dynamodb) is gated on kms:Decrypt\
    \ \u2014 emit CONDITIONAL(key_permission) and cite credential-chains:decrypt-gates-secret-read for\
    \ upgrade. Scan on a large table is operationally noisy (CloudTrail + high RCU consumption) but is\
    \ not a false positive \u2014 it is a real capability. dynamodb:Scan with ConsistentRead=true vs.\
    \ eventual consistency does not affect the existence of the read capability."
  narrative: "{principal.name} can read items from DynamoDB table {table.name} via GetItem, Query, or\
    \ Scan (dynamodb:GetItem / Query / Scan), accessing all attribute data the table contains \u2014 including\
    \ any secrets, credentials, or application-sensitive data stored as item attributes."