rage.fail

aws-lightsail-get-db-master-password

derived aws emits CanReadSecret

match (effective permission)

{ "action": "lightsail:GetRelationalDatabaseMasterUserPassword", "resource_type": "AWS::Lightsail::Database" }

emit

source	`<principal>`
target	`<Lightsail relational database in scope>`
permissions	`lightsail:GetRelationalDatabaseMasterUserPassword`
conditions	`network_reachability`
state logic	ACTIVE if DB endpoint reachable else CONDITIONAL(network_reachability)

Narrative

{principal.name} can read the master password of database {target.name} (lightsail:GetRelationalDatabaseMasterUserPassword).

Raw rule rules/derived/aws/lightsail.yaml

id: aws-lightsail-get-db-master-password
emits: CanReadSecret
match_effective_permission:
  action: lightsail:GetRelationalDatabaseMasterUserPassword
  resource_type: AWS::Lightsail::Database
emit:
  source: <principal>
  target: <Lightsail relational database in scope>
  permissions:
  - lightsail:GetRelationalDatabaseMasterUserPassword
  conditions:
  - network_reachability
  escalation: Read the DB master password -> full data-plane access if the DB endpoint is reachable.
  state_logic: ACTIVE if DB endpoint reachable else CONDITIONAL(network_reachability)
  narrative: '{principal.name} can read the master password of database {target.name} (lightsail:GetRelationalDatabaseMasterUserPassword).'