aws-memorydb-create-user-yields-data-write

memorydb:CreateUser + memorydb:UpdateAcl creates a privileged ACL user; with VPC reach, principal can then write all cluster data.

derived aws emits CanWriteData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanCreate {'aclUser': None} {'principal': None} CanModify {'acl': None} {'aclUser': None} CredentialsFor {'cluster': None} {'cluster': None} Contains {'acl': None}

where

node_type(?principal) == Identity node_type(?aclUser) == Credential ?aclUser.provider_type == 'memorydb_acl_user' node_type(?acl) == GenericPolicy ?acl.provider_type == 'AWS::MemoryDB::ACL' node_type(?cluster) == Cache ?cluster.provider == 'aws'

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

{'principal': None} CanNetworkReach {'cluster': None}

emit

source type	`Identity`
target type	`Cache`
source	`?principal`
target	`?cluster`
permissions	`memorydb:CreateUser` `memorydb:UpdateAcl`
conditions	`network_reachability`
state logic	if matched(optional[0]): ACTIVE — the principal has both CreateUser and UpdateACL permissions AND confirmed network reach; they can create a user, add them to the ACL, and write to the cluster. else: CONDITIONAL(network_reachability) — confirm a VPC foothold.

Narrative

{principal.name} can create a new MemoryDB ACL user with full write permissions and add them to {cluster.name}'s ACL (via memorydb:CreateUser and memorydb:UpdateAcl); with VPC network access, {principal.name} can write to the cluster (SET, DEL, FLUSHDB), poisoning cached data or invalidating application sessions.

Raw rule rules/derived/aws/memorydb.yaml

id: aws-memorydb-create-user-yields-data-write
emits: CanWriteData
description: memorydb:CreateUser + memorydb:UpdateAcl creates a privileged ACL user; with VPC reach, principal
  can then write all cluster data.
match:
- - principal: null
  - CanCreate
  - aclUser: null
- - principal: null
  - CanModify
  - acl: null
- - aclUser: null
  - CredentialsFor
  - cluster: null
- - cluster: null
  - Contains
  - acl: null
optional:
- - principal: null
  - CanNetworkReach
  - cluster: null
where:
- node_type(?principal) == Identity
- node_type(?aclUser) == Credential
- ?aclUser.provider_type == 'memorydb_acl_user'
- node_type(?acl) == GenericPolicy
- ?acl.provider_type == 'AWS::MemoryDB::ACL'
- node_type(?cluster) == Cache
- ?cluster.provider == 'aws'
emit:
  source_type: Identity
  target_type: Cache
  source: ?principal
  target: ?cluster
  permissions:
  - memorydb:CreateUser
  - memorydb:UpdateAcl
  conditions:
  - network_reachability
  state_logic: "if matched(optional[0]): ACTIVE \u2014 the principal has both CreateUser and UpdateACL\
    \ permissions AND confirmed network reach; they can create a user, add them to the ACL, and write\
    \ to the cluster. else: CONDITIONAL(network_reachability) \u2014 confirm a VPC foothold."
  confidence: min(contributing_confidences) * 0.80
  derived_from:
  - '<CanCreate edge_id: ?principal -> ?aclUser>'
  - '<CanModify edge_id: ?principal -> ?acl>'
  - '<CredentialsFor edge_id: ?aclUser -> ?cluster>'
  - '<Contains edge_id: ?cluster -> ?acl>'
  - '[optional] <CanNetworkReach edge_id: ?principal -> ?cluster>'
  false_positive_note: "The created ACL user's access string determines write capability: if it is 'on\
    \ ~* &* +@all' (default) or contains +@write / +SET / +DEL patterns, emit ACTIVE (if network reach\
    \ is confirmed). If the access string is read-only, emit BLOCKED. Network reachability is mandatory\
    \ \u2014 MemoryDB is always VPC-private."
  narrative: '{principal.name} can create a new MemoryDB ACL user with full write permissions and add
    them to {cluster.name}''s ACL (via memorydb:CreateUser and memorydb:UpdateAcl); with VPC network access,
    {principal.name} can write to the cluster (SET, DEL, FLUSHDB), poisoning cached data or invalidating
    application sessions.'