rage.fail

aws-msk-connect-exposes-credential

An MSK Connect connector exposes its service execution role credentials to all plugin code running within it via the ECS task-credential endpoint.

derived aws emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'connector': None} ExecutesAs {'role': None}

where

node_type(?connector) == GenericCompute ?connector is an AWS::MSKConnect::Connector

emit

source type	`GenericCompute`
target type	`MachineIdentity`
source	`?connector`
target	`?role`

Narrative

MSK Connect connector {connector.name} exposes the credentials of its service execution role {role.name} to any plugin code running inside it via the ECS task-credential endpoint.

Raw rule rules/derived/aws/msk.yaml

id: aws-msk-connect-exposes-credential
emits: ExposesCredential
description: An MSK Connect connector exposes its service execution role credentials to all plugin code
  running within it via the ECS task-credential endpoint.
match:
- - connector: null
  - ExecutesAs
  - role: null
where:
- node_type(?connector) == GenericCompute
- ?connector is an AWS::MSKConnect::Connector
emit:
  source_type: GenericCompute
  target_type: MachineIdentity
  source: ?connector
  target: ?role
  permissions: []
  state: ACTIVE
  derived_from:
  - ?connector ExecutesAs ?role (aws-msk-connect-executes-as)
  false_positive_note: 'This edge expresses the credential-exposure FACT: running code in the connector
    equals holding the execution role''s short-lived AWS credentials. Not an escalation by itself; its
    attack value depends on a contributing CanModifyCode or CanTrigger edge on the connector. Analogous
    to aws-lambda-exposes-exec-role-cred in lambda.yaml. MSK Connect connectors use the ECS container-credentials
    endpoint (AWS_CONTAINER_CREDENTIALS_FULL_URI / RELATIVE_URI), not IMDS.'
  narrative: MSK Connect connector {connector.name} exposes the credentials of its service execution role
    {role.name} to any plugin code running inside it via the ECS task-credential endpoint.