rage.fail

aws-memorydb-can-create-acl-user

explicit aws emits CanCreate

match (effective permission)

{ "action": "memorydb:CreateUser", "resource_type": "AWS::MemoryDB::User" }

emit

source type	`Identity`
target type	`Credential`
source	`<principal>`
target	`<MemoryDB ACL user Credential node (provider_type: memorydb_acl_user)>`
permissions	`memorydb:CreateUser`

Narrative

{principal.name} can create a new MemoryDB ACL user (memorydb:CreateUser) with a chosen password and access string, then add that user to a cluster's ACL via memorydb:UpdateACL. This allows the attacker to create a credential for accessing the cluster's Redis data plane.

Raw rule rules/explicit/aws-memorydb.yaml

id: aws-memorydb-can-create-acl-user
emits: CanCreate
applies_to:
- aws
match_effective_permission:
  action: memorydb:CreateUser
  resource_type: AWS::MemoryDB::User
emit:
  source_type: Identity
  target_type: Credential
  source: <principal>
  target: '<MemoryDB ACL user Credential node (provider_type: memorydb_acl_user)>'
  permissions:
  - memorydb:CreateUser
  narrative: '{principal.name} can create a new MemoryDB ACL user (memorydb:CreateUser) with a chosen
    password and access string, then add that user to a cluster''s ACL via memorydb:UpdateACL. This allows
    the attacker to create a credential for accessing the cluster''s Redis data plane.'