aws-elasticache-modify-auth-token

id: aws-elasticache-modify-auth-token
emits: CanModifyConfiguration
description: elasticache:ModifyReplicationGroup with AuthToken + AuthTokenUpdateStrategy=SET (or AuthTokenEnabled=false)
  sets or removes the Redis AUTH token to an attacker-controlled value. elasticache:ModifyUser resets
  ACL user passwords. elasticache:ModifyServerlessCache modifies UserGroup bindings. The principal gains
  the capability to mutate cache auth configuration; paired with network reachability, this yields data-plane
  access.
match:
- - principal: null
  - HasPermission
  - cache: null
where:
- generic_type(?cache) == Cache
- ?cache.provider_type in ['AWS::ElastiCache::ReplicationGroup', 'AWS::ElastiCache::CacheCluster', 'AWS::ElastiCache::ServerlessCache']
- ?principal has EFFECTIVE elasticache:ModifyReplicationGroup (or elasticache:ModifyCacheCluster for single-node)
  on ?cache ARN OR ?principal has EFFECTIVE elasticache:ModifyUser on a User attached to ?cache's UserGroup
  OR ?principal has EFFECTIVE elasticache:ModifyServerlessCache on ?cache ARN
- "?cache.properties.Engine in ['redis', 'valkey'] (AUTH token concept does not apply to Memcached \u2014\
  \ emit only for Redis/Valkey)"
emit:
  source_type: Identity
  target_type: Cache
  source: ?principal
  target: ?cache
  permissions:
  - elasticache:ModifyReplicationGroup
  - elasticache:ModifyCacheCluster
  - elasticache:ModifyUser
  - elasticache:ModifyServerlessCache
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: "ACTIVE when elasticache:ModifyReplicationGroup (or ModifyCacheCluster or ModifyServerlessCache)\
    \ is confirmed EFFECTIVE on the cache ARN \u2014 no SCP denial, no permission boundary block. The\
    \ AUTH token set, disable, or user password reset is a single API call; no current token is required\
    \ to change it. CONDITIONAL(iam_permission) when the effective permission is unresolved (e.g., an\
    \ SCP is present but not fully evaluated). BLOCKED when an SCP or permission boundary explicitly denies\
    \ the modify action on the target cluster ARN. Note: the resulting data-plane access is separately\
    \ CONDITIONAL(network_reachability) \u2014 the attacker must hold a VPC foothold to use the new/cleared\
    \ credential. For AuthTokenUpdateStrategy=ROTATE, verify TransitEncryptionEnabled=true (TLS must be\
    \ enabled); without TLS, ROTATE is rejected by AWS API. SET and AuthTokenEnabled=false paths require\
    \ no TLS prerequisite. This CanModifyConfiguration edge models the configuration-mutation capability;\
    \ downstream linchpins (credential-chains) collapse the auth-disable path to CanReadData when network_reachability\
    \ is confirmed."
  confidence: min(contributing_confidences) * 0.90
  derived_from:
  - ?principal CanModifyConfiguration ?cache (elasticache:ModifyReplicationGroup / ModifyServerlessCache
    / ModifyUser effective permission)
  false_positive_note: "This rule applies only to Redis/Valkey clusters \u2014 Memcached has no AUTH mechanism.\
    \ Confirm generic_type == Cache AND engine in ['redis', 'valkey']. AuthTokenUpdateStrategy=ROTATE\
    \ (not SET) adds a second valid token without invalidating the old one \u2014 the attacker gains a\
    \ new valid token but the cluster remains accessible to existing legitimate clients; treat as ACTIVE\
    \ for the credential-mutation capability (the new token is still attacker-known and cluster remains\
    \ accessible). Note: ROTATE strategy requires TransitEncryptionEnabled=true (TLS) per AWS documentation;\
    \ verify this constraint when evaluating ROTATE-specific paths. AuthTokenEnabled=false fully removes\
    \ the auth requirement \u2014 this is higher impact because any VPC-reachable principal can then connect.\
    \ Do NOT emit for Memcached (no AUTH), and do NOT confuse the KMS at-rest key with the AUTH token\
    \ \u2014 they are independent; at-rest encryption does not gate wire-protocol access. Honor SCP denials\
    \ on elasticache:ModifyReplicationGroup."
  narrative: '{principal.name} can call elasticache:ModifyReplicationGroup on {cache.name} to set the
    Redis AUTH token to an attacker-controlled value (AuthTokenUpdateStrategy=SET), or disable AUTH entirely
    (AuthTokenEnabled=false). Alternatively, {principal.name} can call elasticache:ModifyUser to reset
    an ACL user password, or elasticache:ModifyServerlessCache to change UserGroup bindings. Any principal
    with the new/modified credential and VPC network access to {cache.name} can then connect and read
    or write all cached data.'