aws-memorydb-swap-acl-yields-data-read

memorydb:UpdateCluster can swap cluster's ACL to open-access; principal with VPC reach gains full data-plane access to the cluster.

derived aws emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanModifyConfiguration {'cluster': None}

where

node_type(?cluster) == Cache ?cluster.provider_type == 'AWS::MemoryDB::Cluster' ?cluster.provider == 'aws' ?principal has EFFECTIVE memorydb:UpdateCluster on ?cluster ARN (via explicit normalization rule aws-memorydb-update-cluster-modifies-config)

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

{'principal': None} CanNetworkReach {'cluster': None}

emit

source type	`Identity`
target type	`Cache`
source	`?principal`
target	`?cluster`
permissions	`memorydb:UpdateCluster`
conditions	`network_reachability` `iam_permission` `scp_or_org_policy`
state logic	CONDITIONAL(network_reachability): the principal can call memorydb:UpdateCluster to set the cluster's ACL to "open-access" (or another permissive ACL), removing authentication barriers. However, the cluster is always VPC-private; data access requires network reach. If matched(optional[0]): ACTIVE — the principal has both UpdateCluster permission AND confirmed network reach to the cluster; escalation is complete. Else: CONDITIONAL(network_reachability) — the principal must obtain a VPC foothold (via compromised EC2, Lambda, ECS task, etc.) to exploit the open-access ACL.

Narrative

{principal.name} can call memorydb:UpdateCluster to swap {cluster.name}'s ACL to the built-in "open-access" ACL. This removes authentication barriers and allows any principal with VPC network reach to the cluster to read (and write) all data using the default user's full permissions ('on ~* &* +@all'). If {principal.name} already has confirmed network reach to the cluster, escalation is complete: full data exfiltration.

Raw rule rules/derived/aws/memorydb.yaml

id: aws-memorydb-swap-acl-yields-data-read
emits: CanReadData
description: memorydb:UpdateCluster can swap cluster's ACL to open-access; principal with VPC reach gains
  full data-plane access to the cluster.
match:
- - principal: null
  - CanModifyConfiguration
  - cluster: null
optional:
- - principal: null
  - CanNetworkReach
  - cluster: null
where:
- node_type(?cluster) == Cache
- ?cluster.provider_type == 'AWS::MemoryDB::Cluster'
- ?cluster.provider == 'aws'
- ?principal has EFFECTIVE memorydb:UpdateCluster on ?cluster ARN (via explicit normalization rule aws-memorydb-update-cluster-modifies-config)
emit:
  source_type: Identity
  target_type: Cache
  source: ?principal
  target: ?cluster
  permissions:
  - memorydb:UpdateCluster
  conditions:
  - network_reachability
  - iam_permission
  - scp_or_org_policy
  state_logic: "CONDITIONAL(network_reachability): the principal can call memorydb:UpdateCluster to set\
    \ the cluster's ACL to \"open-access\" (or another permissive ACL), removing authentication barriers.\
    \ However, the cluster is always VPC-private; data access requires network reach. If matched(optional[0]):\
    \ ACTIVE \u2014 the principal has both UpdateCluster permission AND confirmed network reach to the\
    \ cluster; escalation is complete. Else: CONDITIONAL(network_reachability) \u2014 the principal must\
    \ obtain a VPC foothold (via compromised EC2, Lambda, ECS task, etc.) to exploit the open-access ACL."
  confidence: min(contributing_confidences) * 0.75
  derived_from:
  - '<CanModifyConfiguration edge_id: ?principal -> ?cluster>'
  - '[optional] <CanNetworkReach edge_id: ?principal -> ?cluster>'
  false_positive_note: "This rule assumes the cluster CAN use the open-access ACL. The built-in ACL is\
    \ always available, so the risk is always present if UpdateCluster permission exists. TLS provides\
    \ transport-layer encryption but does NOT impose authentication requirements \u2014 the \"default\"\
    \ user in the open-access ACL has no password requirement regardless of TLS status. Both TLS-enabled\
    \ and TLS-disabled clusters with open-access are equally exploitable: any VPC-reachable principal\
    \ can authenticate as the default user and read/write all data. Downgrade confidence only if the cluster\
    \ uses a non-open-access custom ACL with confirmed restrictive user permissions AND TLS is enabled.\
    \ CONDITIONAL(network_reachability) is mandatory \u2014 MemoryDB is always VPC-private."
  narrative: '{principal.name} can call memorydb:UpdateCluster to swap {cluster.name}''s ACL to the built-in
    "open-access" ACL. This removes authentication barriers and allows any principal with VPC network
    reach to the cluster to read (and write) all data using the default user''s full permissions (''on
    ~* &* +@all''). If {principal.name} already has confirmed network reach to the cluster, escalation
    is complete: full data exfiltration.'