aws-neptune-modify-config-yields-read-data

id: aws-neptune-modify-config-yields-read-data
emits: CanReadData
description: Principal with CanModifyConfiguration on a Neptune cluster can disable IAM authentication
  to escalate to CanReadData if the cluster is publicly accessible or network-reachable.
match:
- - principal: null
  - CanModifyConfiguration
  - cluster: null
- - cluster: null
  - ExposedToInternet
  - anon: null
where:
- node_type(?cluster) == NoSQLDatabase
- ?cluster.EnableIAMDatabaseAuthentication == true (must be enableable; rule applies when it CAN be disabled)
emit:
  source_type: Identity
  target_type: NoSQLDatabase
  source: ?principal
  target: ?cluster
  permissions:
  - rds:ModifyDBCluster
  conditions:
  - iam_permission
  - condition_expression
  derived_from:
  - CanModifyConfiguration(?principal, ?cluster)
  - ExposedToInternet(?cluster, ?anon)
  state_logic: "CONDITIONAL(condition_expression) because the escalation path requires an additional action\
    \ before CanReadData becomes ACTIVE: (1) principal has CanModifyConfiguration (confirmed by the match),\
    \ (2) cluster is ExposedToInternet (confirmed by the match, so network\n    reachability is already\
    \ satisfied), AND\n(3) principal must execute rds:ModifyDBCluster to disable\n    EnableIAMDatabaseAuthentication,\
    \ and then issue unauthenticated queries.\nThe blocking precondition is the intermediate two-step\
    \ action requirement (disable IAM auth, then query), not network reachability. Network reachability\
    \ is a prerequisite already confirmed by the ExposedToInternet match. If the cluster is not ExposedToInternet\
    \ or if IAM auth is already false, this rule does not apply."
  narrative: "{principal.name} can modify Neptune cluster {cluster.name} configuration and the cluster\
    \ is exposed to the internet; by executing rds:ModifyDBCluster to disable IAM database authentication\
    \ (EnableIAMDatabaseAuthentication=false), {principal.name} can then issue unauthenticated queries\
    \ and read all graph data without credentials \u2014 a two-step escalation from configuration control\
    \ to data access."