aws-msk-can-read-data
kafka-cluster:ReadData grants IAM-level consume permission from the target MSK topic, enabling data-plane read of message contents.
match (effective permission)
{
"action": "kafka-cluster:ReadData",
"resource_type": [
"topic",
"AWS::MSK::Cluster"
]
}
where
resource_type == 'topic' OR (resource_type == 'AWS::MSK::Cluster' AND ARN suffix contains '/topic/' OR ends with '/*')
emit
| source type | Identity |
|---|---|
| target type | Queue |
| source | <principal> |
| target | <MSK topic (Queue) node, or GenericMessaging if cluster-scoped> |
| permissions | kafka-cluster:ReadData |
| conditions | iam_permission resource_policy |
| state logic | ACTIVE when the principal has effective kafka-cluster:ReadData (+ implicitly kafka-cluster:Connect and kafka-cluster:DescribeGroup for consumer group coordination) at the topic or cluster scope. Same IAM + Kafka-ACL dual-plane caveat as CanWriteData applies. BLOCKED if SCP, permission boundary, or explicit deny applies. Honor kafka-cluster:topic scoping. |
Narrative
{principal.name} can consume messages from MSK topic {target.name} (kafka-cluster:ReadData). Reading from the topic allows direct data exfiltration of message contents; if messages carry credentials, credential-chains will surface the impersonation consequence.
Raw rule rules/derived/aws/msk.yaml
id: aws-msk-can-read-data
emits: CanReadData
description: kafka-cluster:ReadData grants IAM-level consume permission from the target MSK topic, enabling
data-plane read of message contents.
match_effective_permission:
action: kafka-cluster:ReadData
resource_type:
- topic
- AWS::MSK::Cluster
where:
- resource_type == 'topic' OR (resource_type == 'AWS::MSK::Cluster' AND ARN suffix contains '/topic/'
OR ends with '/*')
emit:
source_type: Identity
target_type: Queue
source: <principal>
target: <MSK topic (Queue) node, or GenericMessaging if cluster-scoped>
permissions:
- kafka-cluster:ReadData
conditions:
- iam_permission
- resource_policy
state_logic: ACTIVE when the principal has effective kafka-cluster:ReadData (+ implicitly kafka-cluster:Connect
and kafka-cluster:DescribeGroup for consumer group coordination) at the topic or cluster scope. Same
IAM + Kafka-ACL dual-plane caveat as CanWriteData applies. BLOCKED if SCP, permission boundary, or
explicit deny applies. Honor kafka-cluster:topic scoping.
derived_from:
- effective kafka-cluster:ReadData at MSK topic/cluster scope
false_positive_note: "Same dual-authorization caveat as CanWriteData (A1): IAM grant alone may be blocked\
\ at Kafka ACL level. kafka-cluster:ReadData requires kafka-cluster:Connect and typically kafka-cluster:DescribeGroup\
\ as prerequisites. For consumer group offset management, kafka-cluster:AlterGroup is also required.\
\ Verify all prerequisites are present in the effective-permission evaluation to avoid over-claiming.\
\ When messages contain secrets or credentials (ContainsSecret/ContainsCredential), credential-chains.read-secret-yields-identity\
\ rolls up the consequence \u2014 cite, do not re-derive."
confidence: 0.85
narrative: '{principal.name} can consume messages from MSK topic {target.name} (kafka-cluster:ReadData).
Reading from the topic allows direct data exfiltration of message contents; if messages carry credentials,
credential-chains will surface the impersonation consequence.'