rage.fail

aws-memorydb-can-modify-acl-user

explicit aws emits CanModify

match (effective permission)

{ "action": "memorydb:UpdateUser", "resource_type": "AWS::MemoryDB::User" }

emit

source type	`Identity`
target type	`Credential`
source	`<principal>`
target	`<MemoryDB ACL user Credential node (provider_type: memorydb_acl_user)>`
permissions	`memorydb:UpdateUser`

Narrative

{principal.name} can overwrite the authentication password of MemoryDB ACL user {user.name} (memorydb:UpdateUser), setting an attacker-controlled wire-protocol credential for the Redis cluster.

Raw rule rules/explicit/aws-memorydb.yaml

id: aws-memorydb-can-modify-acl-user
emits: CanModify
applies_to:
- aws
match_effective_permission:
  action: memorydb:UpdateUser
  resource_type: AWS::MemoryDB::User
emit:
  source_type: Identity
  target_type: Credential
  source: <principal>
  target: '<MemoryDB ACL user Credential node (provider_type: memorydb_acl_user)>'
  permissions:
  - memorydb:UpdateUser
  narrative: '{principal.name} can overwrite the authentication password of MemoryDB ACL user {user.name}
    (memorydb:UpdateUser), setting an attacker-controlled wire-protocol credential for the Redis cluster.'