aws-glue-connection-exposes-credential

A Glue Connection stores JDBC/Kafka/OAuth credentials; glue:GetConnection returns the plaintext PASSWORD, exposing the database credential.

derived aws emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Secret`
target type	`Credential`
source	`?connection`
target	`?credential`
permissions	`glue:GetConnection`
conditions	`iam_permission` `key_permission`
state logic	ACTIVE when the PASSWORD field is non-empty and is not encrypted by a customer-managed key the caller cannot decrypt. CONDITIONAL(key_permission) if the connection's password is wrapped under a SecurityConfiguration encryption key and the retriever lacks kms:Decrypt on that key.

source type

Secret

target type

Credential

source

?connection

target

?credential

permissions

glue:GetConnection

conditions

iam_permission key_permission

state logic

ACTIVE when the PASSWORD field is non-empty and is not encrypted by a customer-managed key the caller cannot decrypt. CONDITIONAL(key_permission) if the connection's password is wrapped under a SecurityConfiguration encryption key and the retriever lacks kms:Decrypt on that key.

Narrative

Glue Connection {connection.name} stores a plaintext JDBC password (or OAuth token) for {credential.target}; any principal with glue:GetConnection on this connection can retrieve it and authenticate to the target data store.

Raw rule rules/derived/aws/glue.yaml

id: aws-glue-connection-exposes-credential
emits: ExposesCredential
description: A Glue Connection stores JDBC/Kafka/OAuth credentials; glue:GetConnection returns the plaintext
  PASSWORD, exposing the database credential.
applies_to:
- aws
match:
- - connection: null
  - ContainsSecret
  - credential: null
where:
- node_type(?connection) == ConnectionString
- ?connection has non-empty ConnectionProperties.PASSWORD or OAuth token
emit:
  source_type: Secret
  target_type: Credential
  source: ?connection
  target: ?credential
  permissions:
  - glue:GetConnection
  conditions:
  - iam_permission
  - key_permission
  state_logic: ACTIVE when the PASSWORD field is non-empty and is not encrypted by a customer-managed
    key the caller cannot decrypt. CONDITIONAL(key_permission) if the connection's password is wrapped
    under a SecurityConfiguration encryption key and the retriever lacks kms:Decrypt on that key.
  confidence: 0.95
  derived_from:
  - <ContainsSecret(connection, credential) edge_id>
  false_positive_note: "Glue may encrypt connection passwords with an SSE-KMS key specified in the SecurityConfiguration;\
    \ if so, glue:GetConnection returns ciphertext, and the caller needs kms:Decrypt on the CMK to obtain\
    \ plaintext \u2014 downgrade to CONDITIONAL(key_permission). Connections with NETWORK_TYPE=JDBC typically\
    \ have plaintext PASSWORD; Kafka connections may use certificate auth (no PASSWORD field). For OAuth\
    \ connections, the access token or client secret in ConnectionProperties is the sensitive field. credential-chains\
    \ read-secret-yields-identity rolls up this ExposesCredential + CredentialsFor to CanImpersonate the\
    \ DB identity \u2014 cite credential-chains, do not re-derive here."
  narrative: Glue Connection {connection.name} stores a plaintext JDBC password (or OAuth token) for {credential.target};
    any principal with glue:GetConnection on this connection can retrieve it and authenticate to the target
    data store.