aws-neptune-can-administer
Principal with rds:ModifyDBCluster on the cluster resource ARN can administer the cluster: modify IAM auth settings, VPC security groups, parameter groups, and deletion protection.
match (effective permission)
{
"action": "rds:ModifyDBCluster",
"resource_type": "AWS::Neptune::DBCluster"
}
emit
| source type | Identity |
|---|---|
| target type | NoSQLDatabase |
| source | <principal> |
| target | <Neptune cluster (NoSQLDatabase)> |
| permissions | rds:ModifyDBCluster |
Narrative
{principal.name} can administer Neptune cluster {cluster.name} via rds:ModifyDBCluster, including disabling IAM database authentication, modifying VPC security groups, changing parameter groups, and toggling deletion protection - full administrative configuration control.
Raw rule rules/explicit/aws-neptune.yaml
id: aws-neptune-can-administer
emits: CanAdminister
applies_to:
- aws
description: 'Principal with rds:ModifyDBCluster on the cluster resource ARN can administer the cluster:
modify IAM auth settings, VPC security groups, parameter groups, and deletion protection.'
match_effective_permission:
action: rds:ModifyDBCluster
resource_type: AWS::Neptune::DBCluster
emit:
source_type: Identity
target_type: NoSQLDatabase
source: <principal>
target: <Neptune cluster (NoSQLDatabase)>
permissions:
- rds:ModifyDBCluster
narrative: "{principal.name} can administer Neptune cluster {cluster.name} via rds:ModifyDBCluster,\
\ including disabling IAM database authentication, modifying VPC security groups, changing parameter\
\ groups, and toggling deletion protection \u2014 full administrative configuration control."