aws-memorydb-update-user-yields-data-write

memorydb:UpdateUser overwrites an ACL user password (CanModify on Credential); attacker with VPC reach can then authenticate and write cluster data.

derived aws emits CanWriteData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanModify {'aclUser': None} {'aclUser': None} CredentialsFor {'cluster': None}

where

node_type(?aclUser) == Credential ?aclUser.provider_type == 'memorydb_acl_user' node_type(?cluster) == Cache ?cluster.provider == 'aws'

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

{'principal': None} CanNetworkReach {'cluster': None}

emit

source type	`Identity`
target type	`Cache`
source	`?principal`
target	`?cluster`
permissions	`memorydb:UpdateUser`
conditions	`network_reachability`
state logic	if matched(optional[0]): ACTIVE — network reach to the cluster is already derived and confirmed; the principal can reset the ACL user password and authenticate immediately, then issue write commands. else: CONDITIONAL(network_reachability) — the cluster endpoint is always VPC-private; confirm a VPC foothold before upgrading to ACTIVE.

Narrative

{principal.name} can overwrite the password of ACL user {aclUser.name} (memorydb:UpdateUser), whose credentials authenticate to MemoryDB cluster {cluster.name}; with VPC network access to the cluster endpoint, {principal.name} can write to {cluster.name} (SET, DEL, FLUSHDB, etc.), poisoning cached data or invalidating application sessions.

Raw rule rules/derived/aws/memorydb.yaml

id: aws-memorydb-update-user-yields-data-write
emits: CanWriteData
description: memorydb:UpdateUser overwrites an ACL user password (CanModify on Credential); attacker with
  VPC reach can then authenticate and write cluster data.
match:
- - principal: null
  - CanModify
  - aclUser: null
- - aclUser: null
  - CredentialsFor
  - cluster: null
optional:
- - principal: null
  - CanNetworkReach
  - cluster: null
where:
- node_type(?aclUser) == Credential
- ?aclUser.provider_type == 'memorydb_acl_user'
- node_type(?cluster) == Cache
- ?cluster.provider == 'aws'
emit:
  source_type: Identity
  target_type: Cache
  source: ?principal
  target: ?cluster
  permissions:
  - memorydb:UpdateUser
  conditions:
  - network_reachability
  state_logic: "if matched(optional[0]): ACTIVE \u2014 network reach to the cluster is already derived\
    \ and confirmed; the principal can reset the ACL user password and authenticate immediately, then\
    \ issue write commands. else: CONDITIONAL(network_reachability) \u2014 the cluster endpoint is always\
    \ VPC-private; confirm a VPC foothold before upgrading to ACTIVE."
  confidence: min(contributing_confidences) * 0.85
  derived_from:
  - '<CanModify edge_id: ?principal -> ?aclUser>'
  - '<CredentialsFor edge_id: ?aclUser -> ?cluster>'
  - '[optional] <CanNetworkReach edge_id: ?principal -> ?cluster>'
  false_positive_note: "Only emit when the CanModify edge is backed by memorydb:UpdateUser on the specific\
    \ ACL user (provider_type memorydb_acl_user) whose CredentialsFor link targets this cluster. The ACL\
    \ user's access string must permit write commands: if the string is 'on ~* &* +@all' (default) or\
    \ contains write patterns (+@write, +SET, +DEL, etc.), emit ACTIVE. If the string is known to be read-only\
    \ (+@read only), emit BLOCKED. If unknown, emit CONDITIONAL(resource_policy). CONDITIONAL(network_reachability)\
    \ is mandatory \u2014 MemoryDB is always VPC-private. Do NOT emit CanImpersonate or CanAssume \u2014\
    \ ACL users are not IAM identities; data-plane access is not IAM role assumption."
  narrative: '{principal.name} can overwrite the password of ACL user {aclUser.name} (memorydb:UpdateUser),
    whose credentials authenticate to MemoryDB cluster {cluster.name}; with VPC network access to the
    cluster endpoint, {principal.name} can write to {cluster.name} (SET, DEL, FLUSHDB, etc.), poisoning
    cached data or invalidating application sessions.'