aws-memorydb-vpc-reach-yields-data-write

id: aws-memorydb-vpc-reach-yields-data-write
emits: CanWriteData
description: Compute with confirmed VPC network reach to the cluster plus access to an ACL credential
  can write Redis data (default ACL permissions allow writes).
match:
- - compute: null
  - CanNetworkReach
  - cluster: null
- - cluster: null
  - ExposesCredential
  - aclUser: null
where:
- node_class(?compute) == Compute
- node_type(?cluster) == Cache
- ?cluster.provider == 'aws'
emit:
  source_type: Compute
  target_type: Cache
  source: ?compute
  target: ?cluster
  permissions: []
  conditions:
  - network_reachability
  state_logic: 'if confirmed CanNetworkReach(compute -> cluster, port 6379/TLS) AND (cluster uses open-access
    ACL with no AUTH required, OR compute can obtain the ACL credential via ExposesCredential chain) AND
    the ACL user''s access string permits write commands (default is ''on ~* &* +@all'' which allows all
    commands): ACTIVE. If network reach is confirmed but the credential''s access string is known to restrict
    writes (e.g., read-only ACL): BLOCKED. If network reach is confirmed but credential acquisition or
    ACL scope is CONDITIONAL: CONDITIONAL(resource_policy). If network reach is not yet confirmed: CONDITIONAL(network_reachability).'
  confidence: min(contributing_confidences) * 0.85
  derived_from:
  - '<CanNetworkReach edge_id: ?compute -> ?cluster>'
  - '<ExposesCredential edge_id: ?cluster -> ?aclUser>'
  false_positive_note: "Require the same security-group-level confirmation as rule B2 (CanReadData). The\
    \ ACL user's access string is the write-permission gate: if the string is 'on ~* &* +@all' (default)\
    \ or contains write-permitting patterns (+@write, +SET, +DEL, etc.), emit ACTIVE. If the string is\
    \ known to be read-only (e.g., '+@read' or no write commands listed), emit BLOCKED. If the access\
    \ string is unknown or unresolved, emit CONDITIONAL(resource_policy). MemoryDB's default ACL users\
    \ grant full access; most production deployments create custom ACLs with limited scopes \u2014 check\
    \ the actual access string before upgrading to ACTIVE."
  narrative: '{compute.name} can reach the MemoryDB cluster {cluster.name} over the Redis TLS endpoint
    (confirmed VPC/security-group reach) and the cluster exposes ACL user credentials {aclUser.name} whose
    access string permits write commands; {compute.name} can authenticate and write to the cluster, potentially
    poisoning cached data or invalidating application sessions.'