aws-memorydb-vpc-reach-yields-data-read

id: aws-memorydb-vpc-reach-yields-data-read
emits: CanReadData
description: Compute with confirmed VPC network reach to the cluster plus access to an ACL credential
  can read Redis data.
match:
- - compute: null
  - CanNetworkReach
  - cluster: null
- - cluster: null
  - ExposesCredential
  - aclUser: null
where:
- node_class(?compute) == Compute
- node_type(?cluster) == Cache
- ?cluster.provider == 'aws'
emit:
  source_type: Compute
  target_type: Cache
  source: ?compute
  target: ?cluster
  permissions: []
  conditions:
  - network_reachability
  state_logic: "if confirmed CanNetworkReach(compute -> cluster, port 6379/TLS) AND (cluster uses open-access\
    \ ACL with no AUTH required, OR compute can obtain the ACL credential via ExposesCredential chain):\
    \ ACTIVE. If network reach is confirmed but credential acquisition path is CONDITIONAL: CONDITIONAL(resource_policy)\
    \ \u2014 the credential availability (whether the Compute node can actually obtain the ACL credential\
    \ from the ExposesCredential chain) is the unsatisfied condition, not an IAM permission issue. If\
    \ network reach is not yet confirmed: CONDITIONAL(network_reachability)."
  confidence: min(contributing_confidences) * 0.9
  derived_from:
  - '<CanNetworkReach edge_id: ?compute -> ?cluster>'
  - '<ExposesCredential edge_id: ?cluster -> ?aclUser>'
  false_positive_note: "Require security-group-level confirmation that port 6379 (TLS) is open from the\
    \ compute's security group to the cluster's security group; same- VPC membership alone is insufficient.\
    \ For open-access (no-TLS, no-AUTH) clusters, the credential gate is absent: state is ACTIVE on network\
    \ reach alone. Do NOT emit ExposedToInternet for MemoryDB \u2014 clusters are always VPC-private and\
    \ have no public endpoint option. Do NOT elevate to CanImpersonate; data-plane access grants Redis\
    \ commands, not IAM identity. Note: MemoryDB ACL users can both read AND write cluster data by default\
    \ (access string 'on ~* &* +@all' grants full command and key access); CanWriteData is emitted as\
    \ a companion capability. Downgrade confidence if the ACL access string is known to restrict writes."
  narrative: '{compute.name} can reach the MemoryDB cluster {cluster.name} over the Redis TLS endpoint
    (confirmed VPC/security-group reach) and the cluster exposes ACL user credentials {aclUser.name};
    {compute.name} can authenticate and read or write cluster data.'