rage.fail

aws-memorydb-acl-user-credentials-for-cluster

explicit aws emits CredentialsFor

match (effective permission)

{ "action": "memorydb:DescribeUsers", "resource_type": "AWS::MemoryDB::User" }

where

?user.properties.ACLNames is present and non-empty

emit

source type	`Credential`
target type	`Cache`
source	`<ACL user Credential node>`
target	`<MemoryDB cluster Cache node(s) associated with the ACL(s) containing this user>`

Narrative

ACL user {user.name} can authenticate to MemoryDB cluster {cluster.name} via the Redis wire protocol using their password (username + password per ACL configuration). The user's access string determines which commands and keys they can read/write.

Raw rule rules/explicit/aws-memorydb.yaml

id: aws-memorydb-acl-user-credentials-for-cluster
emits: CredentialsFor
applies_to:
- aws
match_effective_permission:
  action: memorydb:DescribeUsers
  resource_type: AWS::MemoryDB::User
where:
- ?user.properties.ACLNames is present and non-empty
emit:
  source_type: Credential
  target_type: Cache
  source: <ACL user Credential node>
  target: <MemoryDB cluster Cache node(s) associated with the ACL(s) containing this user>
  api_source: memorydb:DescribeUsers + memorydb:DescribeACLs + memorydb:DescribeClusters
  evidence_field: user.ACLNames -> ACLs[] -> Clusters[] on each ACL
  record_property:
    node: <user Credential node>
    key: authenticates_to_clusters
    value: <list of cluster ARNs / cluster names from ACL->Clusters[]>
  narrative: ACL user {user.name} can authenticate to MemoryDB cluster {cluster.name} via the Redis wire
    protocol using their password (username + password per ACL configuration). The user's access string
    determines which commands and keys they can read/write.