aws-mq-broker-exposes-credential

id: aws-mq-broker-exposes-credential
emits: ExposesCredential
description: An Amazon MQ broker exposes the wire-protocol credentials of its broker users; these are
  modeled as Credential nodes and grant data-plane publish/consume access.
match:
- - broker_user_cred: null
  - CredentialsFor
  - broker_user_identity: null
where:
- node_type(?broker_user_cred) == Credential
- node_type(?broker_user_identity) == ServiceIdentity
- ?broker_user_identity.properties.broker_arn exists
optional:
- - broker: null
  - CanTrigger
  - consumer: null
emit:
  source_type: Messaging
  target_type: Credential
  source: <broker GenericMessaging node from ?broker_user_identity.properties.broker_arn>
  target: ?broker_user_cred
  permissions: []
  conditions: []
  state_logic: ACTIVE when the broker user credential is documented (CredentialsFor edge exists and broker
    is confirmed via the user identity's broker_arn property). The broker maintains user credentials in
    its data store regardless of whether they are also in Secrets Manager or whether an ESM binding exists.
  confidence: 'if matched(optional[0]): 0.9 else: 0.8'
  derived_from:
  - ?broker_user_cred CredentialsFor ?broker_user_identity (broker user identity)
  false_positive_note: "Broker user credentials are NOT IAM identities \u2014 they grant wire-protocol\
    \ data-plane access only. Reading them does not directly yield IAM privilege; escalation requires\
    \ also publishing to the broker (network reachable) to trigger a Lambda consumer and inherit the Lambda\
    \ execution role. Do not conflate broker credential read with IAM role assumption. The ExposesCredential\
    \ fact feeds credential-chains (read-secret-yields-identity rule) when the credential is read from\
    \ Secrets Manager, but the credential target must be the Credential node, not the broker directly.\
    \ A standalone broker with no ESM binding still exposes credentials to any network-reachable attacker;\
    \ the confidence is slightly lower (0.8) when ESM is absent, reflecting reduced observability but\
    \ not reducing the actual exposure."
  narrative: '{broker.name} (Amazon MQ broker) maintains wire-protocol user credentials for data-plane
    access. {broker_user_cred.name} is the credential for {broker_user_identity.name}; any principal that
    can read it can authenticate to the broker data plane and publish messages (if network reachable).'