aws-msk-connect-can-modify-configuration
kafkaconnect:UpdateConnector modifies connector task count, settings (topic routing, downstream endpoint, embedded credentials), and capacity - configuration changes with security-relevant side effects.
match (effective permission)
{
"action": "kafkaconnect:UpdateConnector",
"resource_type": "AWS::MSKConnect::Connector"
}
emit
| source type | Identity |
|---|---|
| target type | GenericCompute |
| source | <principal> |
| target | <MSK Connect Connector (GenericCompute)> |
| permissions | kafkaconnect:UpdateConnector |
| conditions | iam_permission |
| state logic | ACTIVE when the principal has effective kafkaconnect:UpdateConnector on the connector scope. Connector settings can include JDBC connection strings with embedded credentials, Kafka topic mappings, and downstream write targets — changing them is a meaningful configuration modification. The execution role cannot be changed via UpdateConnector (only at create time via CreateConnector), so the config-identity-swap execute-as path does not apply here. BLOCKED if SCP or permission boundary denies kafkaconnect:UpdateConnector. |
Narrative
{principal.name} can call kafkaconnect:UpdateConnector on {connector.name}, changing its task count, Kafka topic mapping, downstream endpoint configuration, or embedded connection credentials - modifications that influence what data the connector routes and to where.
Raw rule rules/derived/aws/msk.yaml
id: aws-msk-connect-can-modify-configuration
emits: CanModifyConfiguration
description: "kafkaconnect:UpdateConnector modifies connector task count, settings (topic routing, downstream\
\ endpoint, embedded credentials), and capacity \u2014 configuration changes with security-relevant\
\ side effects."
match_effective_permission:
action: kafkaconnect:UpdateConnector
resource_type: AWS::MSKConnect::Connector
emit:
source_type: Identity
target_type: GenericCompute
source: <principal>
target: <MSK Connect Connector (GenericCompute)>
permissions:
- kafkaconnect:UpdateConnector
conditions:
- iam_permission
state_logic: "ACTIVE when the principal has effective kafkaconnect:UpdateConnector on the connector\
\ scope. Connector settings can include JDBC connection strings with embedded credentials, Kafka topic\
\ mappings, and downstream write targets \u2014 changing them is a meaningful configuration modification.\
\ The execution role cannot be changed via UpdateConnector (only at create time via CreateConnector),\
\ so the config-identity-swap execute-as path does not apply here. BLOCKED if SCP or permission boundary\
\ denies kafkaconnect:UpdateConnector."
derived_from:
- effective kafkaconnect:UpdateConnector on connector scope
false_positive_note: CanModifyConfiguration on the connector does not by itself yield CanExecuteAs (since
the execution role is immutable post-creation and UpdateConnector does not accept a new identity).
The consequence is attacker-influenced connector behavior (routing to a different topic or downstream
endpoint, embedding new credentials), not a direct execution-identity swap. If the connector uses
a custom plugin and the UpdateConnector also changes the plugin revision, co-emit CanModifyCode (B2).
Can-execute-as.execute-as-via-config-identity-swap does NOT fire here (no CanPassIdentity to a new
role via UpdateConnector).
narrative: "{principal.name} can call kafkaconnect:UpdateConnector on {connector.name}, changing its\
\ task count, Kafka topic mapping, downstream endpoint configuration, or embedded connection credentials\
\ \u2014 modifications that influence what data the connector routes and to where."