aws-neptune-iam-auth-delete-data
Principal with neptune-db:connect and neptune-db:DeleteDataViaQuery on the cluster resource ARN can execute delete queries and erase graph data.
match (effective permission)
{
"action": [
"neptune-db:connect",
"neptune-db:DeleteDataViaQuery"
],
"resource_type": "AWS::Neptune::DBCluster"
}
where
cluster.EnableIAMDatabaseAuthentication == true
emit
| source type | Identity |
|---|---|
| target type | NoSQLDatabase |
| source | <principal> |
| target | <Neptune cluster (NoSQLDatabase)> |
| permissions | neptune-db:connect neptune-db:DeleteDataViaQuery |
| conditions | iam_permission network_reachability |
| state logic | ACTIVE when the principal's effective IAM permissions include both neptune-db:connect and neptune-db:DeleteDataViaQuery on the cluster's neptune-db resource ARN AND the cluster has EnableIAMDatabaseAuthentication set to true AND network reach to the cluster endpoint is confirmed. BLOCKED if an SCP or IAM boundary denies either action. |
Narrative
{principal.name} has neptune-db:connect and neptune-db:DeleteDataViaQuery on Neptune cluster {cluster.name}; with IAM database authentication enabled, {principal.name} can issue SigV4-signed delete queries and erase all graph data (vertices, edges, properties).
Raw rule rules/derived/aws/neptune.yaml
id: aws-neptune-iam-auth-delete-data
emits: CanDeleteData
description: Principal with neptune-db:connect and neptune-db:DeleteDataViaQuery on the cluster resource
ARN can execute delete queries and erase graph data.
match_effective_permission:
action:
- neptune-db:connect
- neptune-db:DeleteDataViaQuery
resource_type: AWS::Neptune::DBCluster
where:
- cluster.EnableIAMDatabaseAuthentication == true
emit:
source_type: Identity
target_type: NoSQLDatabase
source: <principal>
target: <Neptune cluster (NoSQLDatabase)>
permissions:
- neptune-db:connect
- neptune-db:DeleteDataViaQuery
conditions:
- iam_permission
- network_reachability
derived_from:
- HasPermission(neptune-db:connect)
- HasPermission(neptune-db:DeleteDataViaQuery)
state_logic: ACTIVE when the principal's effective IAM permissions include both neptune-db:connect and
neptune-db:DeleteDataViaQuery on the cluster's neptune-db resource ARN AND the cluster has EnableIAMDatabaseAuthentication
set to true AND network reach to the cluster endpoint is confirmed. BLOCKED if an SCP or IAM boundary
denies either action.
narrative: '{principal.name} has neptune-db:connect and neptune-db:DeleteDataViaQuery on Neptune cluster
{cluster.name}; with IAM database authentication enabled, {principal.name} can issue SigV4-signed
delete queries and erase all graph data (vertices, edges, properties).'