rage.fail

aws-memorydb-can-modify-acl

explicit aws emits CanModify

match (effective permission)

{ "action": "memorydb:UpdateAcl", "resource_type": "AWS::MemoryDB::ACL" }

emit

source type	`Identity`
target type	`GenericPolicy`
source	`<principal>`
target	`<MemoryDB ACL node (provider_type: AWS::MemoryDB::ACL)>`
permissions	`memorydb:UpdateAcl`

Narrative

{principal.name} can modify MemoryDB ACL {acl.name} (memorydb:UpdateAcl), adding or removing users from the ACL. By adding a user to an ACL that is attached to a cluster, the attacker can grant that user (and anyone with knowledge of their password) access to the cluster's data plane.

Raw rule rules/explicit/aws-memorydb.yaml

id: aws-memorydb-can-modify-acl
emits: CanModify
applies_to:
- aws
match_effective_permission:
  action: memorydb:UpdateAcl
  resource_type: AWS::MemoryDB::ACL
emit:
  source_type: Identity
  target_type: GenericPolicy
  source: <principal>
  target: '<MemoryDB ACL node (provider_type: AWS::MemoryDB::ACL)>'
  permissions:
  - memorydb:UpdateAcl
  narrative: '{principal.name} can modify MemoryDB ACL {acl.name} (memorydb:UpdateAcl), adding or removing
    users from the ACL. By adding a user to an ACL that is attached to a cluster, the attacker can grant
    that user (and anyone with knowledge of their password) access to the cluster''s data plane.'