aws-memorydb-create-user-yields-data-read

memorydb:CreateUser + memorydb:UpdateAcl creates a privileged ACL user and adds them to a cluster's ACL; with VPC reach, principal can then read all cluster data.

derived aws emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanCreate {'aclUser': None} {'principal': None} CanModify {'acl': None} {'aclUser': None} CredentialsFor {'cluster': None} {'cluster': None} Contains {'acl': None}

where

node_type(?principal) == Identity node_type(?aclUser) == Credential ?aclUser.provider_type == 'memorydb_acl_user' node_type(?acl) == GenericPolicy ?acl.provider_type == 'AWS::MemoryDB::ACL' node_type(?cluster) == Cache ?cluster.provider == 'aws'

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

{'principal': None} CanNetworkReach {'cluster': None}

emit

source type	`Identity`
target type	`Cache`
source	`?principal`
target	`?cluster`
permissions	`memorydb:CreateUser` `memorydb:UpdateAcl`
conditions	`network_reachability`
state logic	if matched(optional[0]): ACTIVE — the principal has both CreateUser and UpdateACL permissions AND confirmed network reach to the cluster; they can create a user, add them to the ACL, and authenticate immediately. else: CONDITIONAL(network_reachability) — confirm a VPC foothold before upgrading to ACTIVE.

Narrative

{principal.name} can create a new MemoryDB ACL user (memorydb:CreateUser) with full permissions ('on ~* &* +@all') and a chosen password, then add that user to the cluster's ACL (memorydb:UpdateAcl). If {principal.name} also has VPC network access to {cluster.name}, they can immediately authenticate as the created user and read all cluster data without needing to reset an existing user's password.

Raw rule rules/derived/aws/memorydb.yaml

id: aws-memorydb-create-user-yields-data-read
emits: CanReadData
description: memorydb:CreateUser + memorydb:UpdateAcl creates a privileged ACL user and adds them to a
  cluster's ACL; with VPC reach, principal can then read all cluster data.
match:
- - principal: null
  - CanCreate
  - aclUser: null
- - principal: null
  - CanModify
  - acl: null
- - aclUser: null
  - CredentialsFor
  - cluster: null
- - cluster: null
  - Contains
  - acl: null
optional:
- - principal: null
  - CanNetworkReach
  - cluster: null
where:
- node_type(?principal) == Identity
- node_type(?aclUser) == Credential
- ?aclUser.provider_type == 'memorydb_acl_user'
- node_type(?acl) == GenericPolicy
- ?acl.provider_type == 'AWS::MemoryDB::ACL'
- node_type(?cluster) == Cache
- ?cluster.provider == 'aws'
emit:
  source_type: Identity
  target_type: Cache
  source: ?principal
  target: ?cluster
  permissions:
  - memorydb:CreateUser
  - memorydb:UpdateAcl
  conditions:
  - network_reachability
  state_logic: "if matched(optional[0]): ACTIVE \u2014 the principal has both CreateUser and UpdateACL\
    \ permissions AND confirmed network reach to the cluster; they can create a user, add them to the\
    \ ACL, and authenticate immediately. else: CONDITIONAL(network_reachability) \u2014 confirm a VPC\
    \ foothold before upgrading to ACTIVE."
  confidence: min(contributing_confidences) * 0.80
  derived_from:
  - '<CanCreate edge_id: ?principal -> ?aclUser>'
  - '<CanModify edge_id: ?principal -> ?acl>'
  - '<CredentialsFor edge_id: ?aclUser -> ?cluster>'
  - '<Contains edge_id: ?cluster -> ?acl>'
  - '[optional] <CanNetworkReach edge_id: ?principal -> ?cluster>'
  false_positive_note: "This rule requires BOTH CreateUser and UpdateACL permissions on the same principal.\
    \ If the principal has only one of these, the rule does not fire. Emit only when both CanCreate and\
    \ CanModify edges are present and backed by the respective memorydb:* permissions. The created ACL\
    \ user must have write permission: check the chosen access string \u2014 default is 'on ~* &* +@all'.\
    \ If the user's access string is constrained or read-only, emit BLOCKED. Network reachability is mandatory:\
    \ confirm a VPC foothold before ACTIVE."
  narrative: '{principal.name} can create a new MemoryDB ACL user (memorydb:CreateUser) with full permissions
    (''on ~* &* +@all'') and a chosen password, then add that user to the cluster''s ACL (memorydb:UpdateAcl).
    If {principal.name} also has VPC network access to {cluster.name}, they can immediately authenticate
    as the created user and read all cluster data without needing to reset an existing user''s password.'