aws-neptune-can-modify-configuration
Principal with rds:ModifyDBCluster on the cluster resource ARN can modify cluster configuration, including disabling IAM database authentication.
match (effective permission)
{
"action": "rds:ModifyDBCluster",
"resource_type": "AWS::Neptune::DBCluster"
}
emit
| source type | Identity |
|---|---|
| target type | NoSQLDatabase |
| source | <principal> |
| target | <Neptune cluster (NoSQLDatabase)> |
| permissions | rds:ModifyDBCluster |
Narrative
{principal.name} can modify Neptune cluster {cluster.name} configuration via rds:ModifyDBCluster, including disabling IAM database authentication (EnableIAMDatabaseAuthentication=false) to remove the IAM access gate.
Raw rule rules/explicit/aws-neptune.yaml
id: aws-neptune-can-modify-configuration
emits: CanModifyConfiguration
applies_to:
- aws
description: Principal with rds:ModifyDBCluster on the cluster resource ARN can modify cluster configuration,
including disabling IAM database authentication.
match_effective_permission:
action: rds:ModifyDBCluster
resource_type: AWS::Neptune::DBCluster
emit:
source_type: Identity
target_type: NoSQLDatabase
source: <principal>
target: <Neptune cluster (NoSQLDatabase)>
permissions:
- rds:ModifyDBCluster
narrative: '{principal.name} can modify Neptune cluster {cluster.name} configuration via rds:ModifyDBCluster,
including disabling IAM database authentication (EnableIAMDatabaseAuthentication=false) to remove
the IAM access gate.'