aws-glue-job-exposes-credential

A Glue job's DefaultArguments or StartJobRun Arguments contain embedded credentials (connection strings, API keys, tokens) that are exposed via glue:GetJob or glue:GetJobRun.

derived aws emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Compute`
target type	`Credential`
source	`?job`
target	`?credential`
permissions	`glue:GetJob` `glue:GetJobRun`
conditions	`iam_permission`
state logic	ACTIVE when the argument is confirmed to contain a non-empty, non-encrypted credential pattern (regex match on AWS access key, connection string, OAuth token, or similar). CONDITIONAL when the argument is encrypted or obfuscated and the caller lacks decryption permissions. BLOCKED if a SecurityConfiguration encryption is applied and the caller cannot decrypt.

source type

Compute

target type

Credential

source

?job

target

?credential

permissions

glue:GetJob glue:GetJobRun

conditions

iam_permission

state logic

ACTIVE when the argument is confirmed to contain a non-empty, non-encrypted credential pattern (regex match on AWS access key, connection string, OAuth token, or similar). CONDITIONAL when the argument is encrypted or obfuscated and the caller lacks decryption permissions. BLOCKED if a SecurityConfiguration encryption is applied and the caller cannot decrypt.

Narrative

Glue job {job.name} stores credentials in its DefaultArguments or per-run Arguments (e.g., connection string, API key); any principal with glue:GetJob or glue:GetJobRun can read these arguments and extract the embedded credentials to authenticate as {credential.target}.

Raw rule rules/derived/aws/glue.yaml

id: aws-glue-job-exposes-credential
emits: ExposesCredential
description: A Glue job's DefaultArguments or StartJobRun Arguments contain embedded credentials (connection
  strings, API keys, tokens) that are exposed via glue:GetJob or glue:GetJobRun.
applies_to:
- aws
match:
- - job: null
  - ContainsCredential
  - credential: null
where:
- node_type(?job) == BatchJob
- ContainsCredential comes from AWS::Glue::Job.DefaultArguments or observed StartJobRun.Arguments matching
  known credential patterns (-- connection string, -- api_key, -- token)
emit:
  source_type: Compute
  target_type: Credential
  source: ?job
  target: ?credential
  permissions:
  - glue:GetJob
  - glue:GetJobRun
  conditions:
  - iam_permission
  state_logic: ACTIVE when the argument is confirmed to contain a non-empty, non-encrypted credential
    pattern (regex match on AWS access key, connection string, OAuth token, or similar). CONDITIONAL when
    the argument is encrypted or obfuscated and the caller lacks decryption permissions. BLOCKED if a
    SecurityConfiguration encryption is applied and the caller cannot decrypt.
  confidence: 0.85
  derived_from:
  - <ContainsCredential(job, credential) edge_id>
  false_positive_note: "Arguments should be scanned at graph-ingestion time for credential patterns (e.g.\
    \ regex on AKIA, connection:://, Bearer, etc.). Encrypted arguments (wrapped under a SecurityConfiguration\
    \ CMK) should yield CONDITIONAL. A principal without glue:GetJob/GetJobRun cannot read the arguments,\
    \ so this is a pure read-permission gate. The embedded credentials are often database or service-account\
    \ credentials intended for the ETL script \u2014 they do NOT represent the Glue job's execution role;\
    \ model the job -> role link via ExecutesAs. This rule surfaces unintended credential leakage in job\
    \ args."
  narrative: Glue job {job.name} stores credentials in its DefaultArguments or per-run Arguments (e.g.,
    connection string, API key); any principal with glue:GetJob or glue:GetJobRun can read these arguments
    and extract the embedded credentials to authenticate as {credential.target}.