aws-msk-connect-describe-exposes-credential

id: aws-msk-connect-describe-exposes-credential
emits: ExposesCredential
description: An MSK Connect connector's configuration (readable via kafkaconnect:DescribeConnector) may
  contain embedded credentials for downstream data stores (JDBC passwords, S3 keys, API credentials).
match_record:
  resource_type: AWS::MSKConnect::Connector
  field: connectorConfiguration
where:
- 'connector.connectorConfiguration contains non-empty sensitive fields (credential-like keys: password,
  credentials, secret, apiKey, connectionString, authToken, token)'
emit:
  source_type: GenericCompute
  target_type: Credential
  source: <MSK Connect Connector (GenericCompute)>
  target: <embedded credential in connector config (JDBC connection string, S3 credentials, database password,
    API key, etc.)>
  permissions: []
  state: CONDITIONAL(service_state)
  conditions:
  - service_state
  derived_from:
  - AWS::MSKConnect::Connector.connectorConfiguration field inspection (kafkaconnect:DescribeConnector
    evidence)
  false_positive_note: "Only emit when the collector has positive evidence of credential-bearing config\
    \ fields (non-null, non-empty password/credentials/secret fields, or connection string URIs with embedded\
    \ credentials). Do not emit if the connector config is empty or the credential fields are redacted\
    \ by the API (AWS redacts sensitive fields in the DescribeConnector response by default \u2014 verify\
    \ that the raw evidence includes unredacted credentials). The downstream target (JDBC database, S3\
    \ bucket, API endpoint, etc.) is named in the config and should be modeled as a separate node for\
    \ the full credential-chains path. When the embedded credentials authenticate to a specific downstream\
    \ identity (database user, S3 bucket cross-account role, etc.), cite credential-chains.read-secret-yields-identity\
    \ for the CanImpersonate roll-up (do not duplicate here). Any principal with kafkaconnect:DescribeConnector\
    \ can read this edge and harvest the credentials."
  narrative: MSK Connect connector {source.name} exposes embedded credentials in its configuration (stored
    in connectorConfiguration fields such as password, connectionString, apiKey, etc.). Any principal
    with kafkaconnect:DescribeConnector permission can read these credentials and use them to authenticate
    to downstream data stores (JDBC database, S3, third-party APIs), enabling lateral movement or data
    exfiltration.