aws-mq-credential-read-yields-publish

Reading the Secrets Manager secret that holds Amazon MQ broker credentials gives the principal the ability to publish to the broker queue (CONDITIONAL on network reachability to the broker endpoint), which messaging-chains then rolls up to CanTrigger on the Lambda consumer.

derived aws emits CanWriteData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanReadSecret {'secret': None} {'secret': None} CredentialsFor {'broker': None}

where

node_type(?secret) == Secret node_type(?broker) == GenericMessaging ?broker.provider_type == 'AWS::AmazonMQ::Broker' secret_is_mq_credential_for(?secret, ?broker)

emit

source type	`Identity`
target type	`Messaging`
source	`?principal`
target	`?broker`
permissions	`secretsmanager:GetSecretValue`
conditions	`iam_permission` `network_reachability`
state logic	CONDITIONAL(network_reachability) when the broker is VPC-private (PubliclyAccessible=false) — the principal must also have network reachability to the broker wire endpoint. ACTIVE when the broker is publicly accessible (PubliclyAccessible=true) AND the CanReadSecret is ACTIVE (no key_permission gate outstanding). Never stronger than the contributing CanReadSecret state (a KMS-gated secret read stays CONDITIONAL(key_permission) until CanDecrypt is confirmed). A security group that blocks all inbound on wire-protocol ports downgrades to CONDITIONAL or BLOCKED even for public brokers.

Narrative

{principal.name} can read {secret.name} (secretsmanager:GetSecretValue), which holds the wire-protocol credentials for {broker.name}; with network access to the broker endpoint, {principal.name} can publish messages to broker queues and trigger any bound Lambda consumer as its execution role.

Raw rule rules/derived/aws/mq.yaml

id: aws-mq-credential-read-yields-publish
emits: CanWriteData
description: Reading the Secrets Manager secret that holds Amazon MQ broker credentials gives the principal
  the ability to publish to the broker queue (CONDITIONAL on network reachability to the broker endpoint),
  which messaging-chains then rolls up to CanTrigger on the Lambda consumer.
match:
- - principal: null
  - CanReadSecret
  - secret: null
- - secret: null
  - CredentialsFor
  - broker: null
where:
- node_type(?secret) == Secret
- node_type(?broker) == GenericMessaging
- ?broker.provider_type == 'AWS::AmazonMQ::Broker'
- secret_is_mq_credential_for(?secret, ?broker)
emit:
  source_type: Identity
  target_type: Messaging
  source: ?principal
  target: ?broker
  permissions:
  - secretsmanager:GetSecretValue
  conditions:
  - iam_permission
  - network_reachability
  state_logic: "CONDITIONAL(network_reachability) when the broker is VPC-private (PubliclyAccessible=false)\
    \ \u2014 the principal must also have network reachability to the broker wire endpoint. ACTIVE when\
    \ the broker is publicly accessible (PubliclyAccessible=true) AND the CanReadSecret is ACTIVE (no\
    \ key_permission gate outstanding). Never stronger than the contributing CanReadSecret state (a KMS-gated\
    \ secret read stays CONDITIONAL(key_permission) until CanDecrypt is confirmed). A security group that\
    \ blocks all inbound on wire-protocol ports downgrades to CONDITIONAL or BLOCKED even for public brokers."
  confidence: 0.8
  derived_from:
  - ?principal CanReadSecret ?secret
  - ?secret CredentialsFor ?broker
  false_positive_note: "This rule bridges IAM credential read to messaging-chains' CanWriteData vocabulary.\
    \ The bridge is approximate: reading the credential does not AUTOMATICALLY grant publish access \u2014\
    \ the attacker must also (a) reach the broker wire endpoint (network_reachability gate) and (b) use\
    \ the credential at the wire level (data-plane action, not IAM-observable). The rule is intentionally\
    \ CONDITIONAL(network_reachability) to avoid over-claiming active publish capability from a VPC-private\
    \ broker. The escalation value comes from messaging-chains rule 1 (CanWriteData + CanTrigger) and\
    \ rule 2 (CanTrigger + ExecutesAs -> CanExecuteAs) \u2014 do not re-derive those here. Honor the CanReadSecret\
    \ gate: if the secret is KMS-encrypted and the principal lacks CanDecrypt, the read is CONDITIONAL(key_permission)\
    \ and this CanWriteData inherits that state. Also: broker user credentials are NOT IAM identities;\
    \ this does not directly yield CanAssume/CanImpersonate."
  narrative: '{principal.name} can read {secret.name} (secretsmanager:GetSecretValue), which holds the
    wire-protocol credentials for {broker.name}; with network access to the broker endpoint, {principal.name}
    can publish messages to broker queues and trigger any bound Lambda consumer as its execution role.'