aws-keyspaces-modify-write-data
IAM-effective cassandra:Modify on a Keyspaces table allows CQL INSERT, UPDATE, and DELETE, enabling data tampering and injection attacks.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?table) ==
NoSQLDatabase
?table.provider_type == 'AWS::Cassandra::Table'
effective_action(?principal, ?table) includes 'cassandra:Modify'
emit
| source type | Identity |
|---|---|
| target type | NoSQLDatabase |
| source | ?principal |
| target | ?table |
| permissions | cassandra:Modify |
| state logic | if ?table.encryptionSpecification.kmsKeyIdentifier is a customer-managed key (not alias/aws/cassandra or AWS-managed): CONDITIONAL(key_permission) — the caller needs kms:GenerateDataKey on the CMK for AWS Keyspaces to encrypt new data before writing. When the principal is confirmed to hold GenerateDataKey on that exact CMK, a provider-agnostic linchpin rule (TBD) should upgrade this to ACTIVE. Otherwise (SSE uses AWS-managed key alias/aws/cassandra): ACTIVE when cassandra:Modify is effective on the table ARN. |
Narrative
{principal.name} can INSERT, UPDATE, or DELETE rows in {table.name} (cassandra:Modify), enabling data-tampering or injection attacks against applications that consume {table.name} contents without independent validation.
Raw rule rules/derived/aws/keyspaces.yaml
id: aws-keyspaces-modify-write-data
emits: CanWriteData
description: IAM-effective cassandra:Modify on a Keyspaces table allows CQL INSERT, UPDATE, and DELETE,
enabling data tampering and injection attacks.
match:
- - principal: null
- HasPermission
- table: null
where:
- node_type(?table) == NoSQLDatabase
- ?table.provider_type == 'AWS::Cassandra::Table'
- effective_action(?principal, ?table) includes 'cassandra:Modify'
emit:
source_type: Identity
target_type: NoSQLDatabase
source: ?principal
target: ?table
permissions:
- cassandra:Modify
conditions_dynamic: 'if ?table.encryptionSpecification.kmsKeyIdentifier is a customer-managed key (not
alias/aws/cassandra or AWS-managed key): [iam_permission, key_permission]; else: [iam_permission]'
state_logic: "if ?table.encryptionSpecification.kmsKeyIdentifier is a customer-managed key (not alias/aws/cassandra\
\ or AWS-managed): CONDITIONAL(key_permission) \u2014 the caller needs kms:GenerateDataKey on the\
\ CMK for AWS Keyspaces to encrypt new data before writing. When the principal is confirmed to hold\
\ GenerateDataKey on that exact CMK, a provider-agnostic linchpin rule (TBD) should upgrade this to\
\ ACTIVE. Otherwise (SSE uses AWS-managed key alias/aws/cassandra): ACTIVE when cassandra:Modify is\
\ effective on the table ARN."
confidence: contributing_confidence * 0.9
derived_from:
- <HasPermission edge for cassandra:Modify on ?table>
false_positive_note: "Honor the exact resource ARN scope. cassandra:Modify on a specific table ARN does\
\ not confer write on other tables in the same keyspace unless the grant covers the keyspace wildcard.\
\ Keyspace-level cassandra:Modify grants apply to all tables in that keyspace; check each table's\
\ encryptionSpecification for CMK gates. IAM conditions (e.g., aws:RequestedRegion, aws:PrincipalTag)\
\ may further restrict the effective permission \u2014 honor all condition_expression gates from the\
\ permission evaluator."
narrative: '{principal.name} can INSERT, UPDATE, or DELETE rows in {table.name} (cassandra:Modify),
enabling data-tampering or injection attacks against applications that consume {table.name} contents
without independent validation.'