rage.fail

aws-memorydb-update-cluster-modifies-config

explicit aws emits CanModifyConfiguration

match (effective permission)

{ "action": "memorydb:UpdateCluster", "resource_type": "AWS::MemoryDB::Cluster" }

emit

source type	`Identity`
target type	`Cache`
source	`<principal>`
target	`<MemoryDB cluster node>`
permissions	`memorydb:UpdateCluster`

Narrative

{principal.name} can call memorydb:UpdateCluster to modify {cluster.name}, including changing the cluster's ACL (--acl-name parameter). By swapping to the "open-access" ACL (or another permissive ACL), the principal can grant full or partial data-plane access to the cluster without changing any passwords or authentication tokens.

Raw rule rules/explicit/aws-memorydb.yaml

id: aws-memorydb-update-cluster-modifies-config
emits: CanModifyConfiguration
applies_to:
- aws
match_effective_permission:
  action: memorydb:UpdateCluster
  resource_type: AWS::MemoryDB::Cluster
emit:
  source_type: Identity
  target_type: Cache
  source: <principal>
  target: <MemoryDB cluster node>
  permissions:
  - memorydb:UpdateCluster
  narrative: '{principal.name} can call memorydb:UpdateCluster to modify {cluster.name}, including changing
    the cluster''s ACL (--acl-name parameter). By swapping to the "open-access" ACL (or another permissive
    ACL), the principal can grant full or partial data-plane access to the cluster without changing any
    passwords or authentication tokens.'