aws-eb-connection-canreadsecret

id: aws-eb-connection-canreadsecret
emits: CanReadSecret
description: events:RetrieveConnectionCredentials returns the raw OAuth2/API-key credential stored in
  an EventBridge Connection; anyone with this action can read the credential.
match:
- - principal: null
  - HasPermission
  - connection: null
where:
- node_type(?connection) == ConnectionString
- effective_action(?principal, ?connection) includes 'events:RetrieveConnectionCredentials'
emit:
  source_type: Identity
  target_type: ConnectionString
  source: ?principal
  target: ?connection
  permissions:
  - events:RetrieveConnectionCredentials
  conditions:
  - iam_permission
  - resource_policy
  state_logic: ACTIVE when events:RetrieveConnectionCredentials is effective on the Connection ARN and
    not denied by SCP or permission boundary. BLOCKED by a deny override. Confidence reflects that the
    credential must be used to authenticate to the target API; the path value depends on what the credential
    authenticates to.
  confidence: 0.9
  derived_from:
  - 'effective IAM evaluation: events:RetrieveConnectionCredentials on ?connection'
  false_positive_note: "events:DescribeConnection does NOT return the credential value \u2014 only events:RetrieveConnectionCredentials\
    \ does. Do not emit CanReadSecret for principals that only have DescribeConnection. The credential\
    \ retrieved is typed by the connection AuthorizationType (API_KEY, OAUTH_CLIENT_CREDENTIALS, BASIC)\
    \ \u2014 a credential-chains CredentialsFor edge is needed to link it to the target API identity;\
    \ emit this CanReadSecret as the first step. If the connection stores short-lived OAuth tokens that\
    \ may be already-expired, downgrade confidence."
  narrative: '{principal.name} can retrieve the raw credential from EventBridge Connection {connection.name}
    (events:RetrieveConnectionCredentials); this credential authenticates to the connection''s target
    API endpoint.'