aws-msk-put-cluster-policy
kafka:PutClusterPolicy allows writing the MSK cluster resource-based policy, enabling the attacker to grant kafka-cluster:WriteData (or ReadData) to arbitrary principals including cross-account ones.
match (effective permission)
{
"action": "kafka:PutClusterPolicy",
"resource_type": "AWS::MSK::Cluster"
}
emit
| source type | Identity |
|---|---|
| target type | ResourcePolicy |
| source | <principal> |
| target | <MSK Cluster ResourcePolicy> |
| permissions | kafka:PutClusterPolicy |
| conditions | iam_permission |
| state logic | ACTIVE when the principal has effective kafka:PutClusterPolicy on the cluster ARN. Writing the policy can grant any kafka-cluster:* action to any principal (including Principal: "*" for broad access, or a cross-account principal for cross-account trust). The escalation consequence (the attacker grants themselves kafka-cluster:WriteData and then triggers Lambda) is a second-order effect — this rule emits the POLICY-MUTATION capability; CanWriteData on the cluster is separately derived after the mutated policy is effective. BLOCKED by SCP or permission boundary denying kafka:PutClusterPolicy. |
Narrative
{principal.name} can write the resource-based policy for MSK cluster {target.name} (kafka:PutClusterPolicy), granting kafka-cluster:WriteData or ReadData to any principal (including cross-account or wildcard principals).
Raw rule rules/derived/aws/msk.yaml
id: aws-msk-put-cluster-policy
emits: CanModifyPolicy
description: kafka:PutClusterPolicy allows writing the MSK cluster resource-based policy, enabling the
attacker to grant kafka-cluster:WriteData (or ReadData) to arbitrary principals including cross-account
ones.
match_effective_permission:
action: kafka:PutClusterPolicy
resource_type: AWS::MSK::Cluster
emit:
source_type: Identity
target_type: ResourcePolicy
source: <principal>
target: <MSK Cluster ResourcePolicy>
permissions:
- kafka:PutClusterPolicy
conditions:
- iam_permission
state_logic: "ACTIVE when the principal has effective kafka:PutClusterPolicy on the cluster ARN. Writing\
\ the policy can grant any kafka-cluster:* action to any principal (including Principal: \"*\" for\
\ broad access, or a cross-account principal for cross-account trust). The escalation consequence\
\ (the attacker grants themselves kafka-cluster:WriteData and then triggers Lambda) is a second-order\
\ effect \u2014 this rule emits the POLICY-MUTATION capability; CanWriteData on the cluster is separately\
\ derived after the mutated policy is effective. BLOCKED by SCP or permission boundary denying kafka:PutClusterPolicy."
derived_from:
- effective kafka:PutClusterPolicy on cluster ARN
false_positive_note: 'This is a policy-write primitive, not a direct data-plane grant. The attacker
must call PutClusterPolicy with content that grants data-plane actions to a controlled principal,
then use that principal to produce to topics. The two-step nature is intentional: this edge signals
the mutation capability; the downstream CanWriteData/CrossAccountTrust edges are emitted from the
resulting (modified) policy state. Do not collapse this into a direct CanExecuteAs; let the linchpins
handle the chain once CanWriteData is present.'
narrative: '{principal.name} can write the resource-based policy for MSK cluster {target.name} (kafka:PutClusterPolicy),
granting kafka-cluster:WriteData or ReadData to any principal (including cross-account or wildcard
principals).'