aws-neptune-iam-auth-write-data
Principal with neptune-db:connect and neptune-db:WriteDataViaQuery on the cluster resource ARN can execute write/mutation queries and modify graph data.
match (effective permission)
{
"action": [
"neptune-db:connect",
"neptune-db:WriteDataViaQuery"
],
"resource_type": "AWS::Neptune::DBCluster"
}
where
cluster.EnableIAMDatabaseAuthentication == true
emit
| source type | Identity |
|---|---|
| target type | NoSQLDatabase |
| source | <principal> |
| target | <Neptune cluster (NoSQLDatabase)> |
| permissions | neptune-db:connect neptune-db:WriteDataViaQuery |
| conditions | iam_permission network_reachability |
| state logic | ACTIVE when the principal's effective IAM permissions include both neptune-db:connect and neptune-db:WriteDataViaQuery on the cluster's neptune-db resource ARN AND the cluster has EnableIAMDatabaseAuthentication set to true AND network reach to the cluster endpoint is confirmed (trivially true for public endpoints; CONDITIONAL(network_reachability) for VPC-private). BLOCKED if an SCP or IAM boundary denies either action. |
Narrative
{principal.name} has neptune-db:connect and neptune-db:WriteDataViaQuery on Neptune cluster {cluster.name}; with IAM database authentication enabled, {principal.name} can issue SigV4-signed write/mutation queries (Gremlin addV/addE, openCypher CREATE/SET, SPARQL INSERT/DELETE) and modify all graph data (vertices, edges, properties), potentially poisoning trust relationships or other critical graph structures.
Raw rule rules/derived/aws/neptune.yaml
id: aws-neptune-iam-auth-write-data
emits: CanWriteData
description: Principal with neptune-db:connect and neptune-db:WriteDataViaQuery on the cluster resource
ARN can execute write/mutation queries and modify graph data.
match_effective_permission:
action:
- neptune-db:connect
- neptune-db:WriteDataViaQuery
resource_type: AWS::Neptune::DBCluster
where:
- cluster.EnableIAMDatabaseAuthentication == true
emit:
source_type: Identity
target_type: NoSQLDatabase
source: <principal>
target: <Neptune cluster (NoSQLDatabase)>
permissions:
- neptune-db:connect
- neptune-db:WriteDataViaQuery
conditions:
- iam_permission
- network_reachability
derived_from:
- HasPermission(neptune-db:connect)
- HasPermission(neptune-db:WriteDataViaQuery)
state_logic: ACTIVE when the principal's effective IAM permissions include both neptune-db:connect and
neptune-db:WriteDataViaQuery on the cluster's neptune-db resource ARN AND the cluster has EnableIAMDatabaseAuthentication
set to true AND network reach to the cluster endpoint is confirmed (trivially true for public endpoints;
CONDITIONAL(network_reachability) for VPC-private). BLOCKED if an SCP or IAM boundary denies either
action.
narrative: '{principal.name} has neptune-db:connect and neptune-db:WriteDataViaQuery on Neptune cluster
{cluster.name}; with IAM database authentication enabled, {principal.name} can issue SigV4-signed
write/mutation queries (Gremlin addV/addE, openCypher CREATE/SET, SPARQL INSERT/DELETE) and modify
all graph data (vertices, edges, properties), potentially poisoning trust relationships or other critical
graph structures.'