aws-neptune-iam-auth-read-data

id: aws-neptune-iam-auth-read-data
emits: CanReadData
description: Principal with neptune-db:connect and neptune-db:ReadDataViaQuery on the cluster resource
  ARN can read all graph data via IAM-authenticated queries.
match_effective_permission:
  action:
  - neptune-db:connect
  - neptune-db:ReadDataViaQuery
  resource_type: AWS::Neptune::DBCluster
where:
- cluster.EnableIAMDatabaseAuthentication == true
- IAM effective permissions include neptune-db:connect on the cluster's resource ARN (arn:aws:neptune-db:<region>:<account>:<cluster-resource-id>/*)
emit:
  source_type: Identity
  target_type: NoSQLDatabase
  source: <principal>
  target: <Neptune cluster (NoSQLDatabase)>
  permissions:
  - neptune-db:connect
  - neptune-db:ReadDataViaQuery
  conditions:
  - iam_permission
  - network_reachability
  derived_from:
  - HasPermission(neptune-db:connect)
  - HasPermission(neptune-db:ReadDataViaQuery)
  state_logic: "ACTIVE when the principal's effective IAM permissions include both neptune-db:connect\
    \ and neptune-db:ReadDataViaQuery on the cluster's neptune-db resource ARN AND the cluster has EnableIAMDatabaseAuthentication\
    \ set to true AND network reach to the cluster endpoint is confirmed (trivially true for public endpoints;\
    \ CONDITIONAL(network_reachability) for VPC-private clusters where the caller is not confirmed in-VPC\
    \ or via PrivateLink/peering). BLOCKED if an SCP or IAM boundary denies either neptune-db:connect\
    \ or neptune-db:ReadDataViaQuery on the cluster scope. On Neptune engine versions older than 1.2.0.0\
    \ that do not enforce fine-grained neptune-db:* actions, neptune-db:connect alone may be sufficient\
    \ \u2014 emit with a note flagging the engine version dependency. If IAMDatabaseAuthenticationEnabled\
    \ is false on the cluster, this IAM-auth path does not apply (see Surface 2 for the no- auth exposure)."
  false_positive_note: "Only emit when EnableIAMDatabaseAuthentication is true on the cluster \u2014 the\
    \ neptune-db:* actions are only evaluated when IAM auth is required. Do not emit ACTIVE for VPC-private\
    \ clusters when network reachability from the principal to the cluster endpoint has not been confirmed;\
    \ downgrade to CONDITIONAL(network_reachability). neptune-db:connect alone (without neptune-db:ReadDataViaQuery)\
    \ is sufficient on engine versions older than 1.2.0.0 but not on newer engines; note this engine-version\
    \ sensitivity in the evidence. The neptune-db: resource ARN uses the DbClusterResourceId (cluster-XXXX),\
    \ not the cluster ARN \u2014 ensure the permission is evaluated against the correct resource ARN format.\
    \ An IAM policy scoped to a specific cluster resource ID does NOT apply to other clusters."
  narrative: '{principal.name} has neptune-db:connect and neptune-db:ReadDataViaQuery on Neptune cluster
    {cluster.name} (resource ID {cluster.DbClusterResourceId}); with IAM database authentication enabled,
    {principal.name} can issue SigV4-signed Gremlin / openCypher / SPARQL queries and read all graph data
    (vertices, edges, properties) from the cluster endpoint.'