aws-msk-can-write-data
kafka-cluster:WriteData grants IAM-level produce permission to the target MSK topic; a published message reaches any consumer bound to that topic via an event-source mapping.
match (effective permission)
{
"action": "kafka-cluster:WriteData",
"resource_type": [
"topic",
"AWS::MSK::Cluster"
]
}
where
resource_type == 'topic' OR (resource_type == 'AWS::MSK::Cluster' AND ARN suffix contains '/topic/' OR ends with '/*')
emit
| source type | Identity |
|---|---|
| target type | Queue |
| source | <principal> |
| target | <MSK topic (Queue) node, or GenericMessaging if cluster-scoped> |
| permissions | kafka-cluster:WriteData |
| conditions | iam_permission resource_policy |
| state logic | ACTIVE when the principal has effective kafka-cluster:WriteData at the topic or cluster scope (IAM policy + any cluster resource-based policy grant, evaluated together). Honor the kafka-cluster:topic condition key: a grant scoped to topic ARN suffix <topic-name> covers only that topic — emit one CanWriteData edge per distinctly-scoped topic when the condition is present. CONDITIONAL(resource_policy) when the grant is in a resource-based policy but the principal's identity-based policy has not been evaluated (conservative for cross-account grants: the cluster policy alone is necessary but not sufficient — the caller also needs kafka-cluster:Connect + kafka-cluster:WriteData in their identity-based policy for cross-account access). BLOCKED if an SCP, permission boundary, or explicit deny on kafka-cluster:WriteData applies. |
Narrative
{principal.name} can produce messages to MSK topic {target.name} on cluster {cluster.name} (kafka-cluster:WriteData). Any consumer bound to this topic via a Lambda event-source mapping will receive the attacker-influenced payload.
Raw rule rules/derived/aws/msk.yaml
id: aws-msk-can-write-data
emits: CanWriteData
description: kafka-cluster:WriteData grants IAM-level produce permission to the target MSK topic; a published
message reaches any consumer bound to that topic via an event-source mapping.
match_effective_permission:
action: kafka-cluster:WriteData
resource_type:
- topic
- AWS::MSK::Cluster
where:
- resource_type == 'topic' OR (resource_type == 'AWS::MSK::Cluster' AND ARN suffix contains '/topic/'
OR ends with '/*')
emit:
source_type: Identity
target_type: Queue
source: <principal>
target: <MSK topic (Queue) node, or GenericMessaging if cluster-scoped>
permissions:
- kafka-cluster:WriteData
conditions:
- iam_permission
- resource_policy
state_logic: "ACTIVE when the principal has effective kafka-cluster:WriteData at the topic or cluster\
\ scope (IAM policy + any cluster resource-based policy grant, evaluated together). Honor the kafka-cluster:topic\
\ condition key: a grant scoped to topic ARN suffix <topic-name> covers only that topic \u2014 emit\
\ one CanWriteData edge per distinctly-scoped topic when the condition is present. CONDITIONAL(resource_policy)\
\ when the grant is in a resource-based policy but the principal's identity-based policy has not been\
\ evaluated (conservative for cross-account grants: the cluster policy alone is necessary but not\
\ sufficient \u2014 the caller also needs kafka-cluster:Connect + kafka-cluster:WriteData in their\
\ identity-based policy for cross-account access). BLOCKED if an SCP, permission boundary, or explicit\
\ deny on kafka-cluster:WriteData applies."
derived_from:
- effective kafka-cluster:WriteData at MSK topic/cluster scope
false_positive_note: "MSK supports TWO independent authorization planes: IAM and Kafka ACLs. This edge\
\ models only the IAM plane. A cluster that uses BOTH IAM and Kafka ACLs may DENY at the Kafka ACL\
\ level even when IAM grants WriteData \u2014 the Kafka ACL decision is data-plane only and not collectible\
\ without broker access. Lower confidence (0.8) when Kafka ACL authorization is also enabled on the\
\ cluster (check DescribeCluster \u2192 clientAuthentication for ACL usage). Also: kafka-cluster:Connect\
\ is a prerequisite for any data-plane action; the principal must also be granted kafka-cluster:Connect\
\ on the cluster \u2014 verify this in the effective-permission evaluation. Honor topic-level scoping\
\ via kafka-cluster:topic condition key: a grant limited to topic X does NOT cover topic Y."
confidence: 0.85
narrative: '{principal.name} can produce messages to MSK topic {target.name} on cluster {cluster.name}
(kafka-cluster:WriteData). Any consumer bound to this topic via a Lambda event-source mapping will
receive the attacker-influenced payload.'