aws-emr-step-args-expose-credential
EMR step arguments (jar args, script args) may contain hardcoded DB passwords, access keys, or connection strings visible via DescribeStep.
match (record)
{
"field": "Step.Config.Args",
"resource_type": "AWS::EMR::Step"
}
where
step arguments contain patterns matching credential material (access key ID, secret, password flag, connection string)
emit
| source type | Compute |
|---|---|
| target type | Credential |
| source | <EMR Step (BatchJob)> |
| target | <embedded credential / Credential> |
Narrative
EMR step {step.name} contains credential material in its step arguments (visible via elasticmapreduce:DescribeStep to any principal with that permission on the cluster).
Raw rule rules/explicit/aws-emr.yaml
id: aws-emr-step-args-expose-credential
emits: ExposesCredential
description: EMR step arguments (jar args, script args) may contain hardcoded DB passwords, access keys,
or connection strings visible via DescribeStep.
match_record:
resource_type: AWS::EMR::Step
field: Step.Config.Args
where:
- step arguments contain patterns matching credential material (access key ID, secret, password flag,
connection string)
emit:
source_type: Compute
target_type: Credential
source: <EMR Step (BatchJob)>
target: <embedded credential / Credential>
state: ACTIVE
conditions: []
api_source: elasticmapreduce:DescribeStep
evidence_field: Step.Config.Args
false_positive_note: Only emit when the argument pattern-matches credential material (e.g. --password,
--jdbc-url with embedded credentials, --access-key, etc.). Generic step arguments (script paths, input
URIs, output URIs) do not emit this edge. A DescribeStep with no credential-shaped arguments is not
a credential exposure.
narrative: EMR step {step.name} contains credential material in its step arguments (visible via elasticmapreduce:DescribeStep
to any principal with that permission on the cluster).