aws-neptune-public-no-iam-auth

id: aws-neptune-public-no-iam-auth
emits: ExposedToInternet
description: Neptune DB instance with a public endpoint, permissive security group (port 8182/8183/8184
  from 0.0.0.0/0), and IAM database authentication disabled is accessible from the internet without any
  credential.
match_record:
  resource_type: AWS::Neptune::DBInstance
where:
- node_type(?instance) == NoSQLDatabase
- ?instance.PubliclyAccessible == true
- parent cluster of ?instance has EnableIAMDatabaseAuthentication == false
- VPC security group for ?instance allows inbound TCP on any Neptune port (8182, 8183, or 8184) from 0.0.0.0/0
  or ::/0 (or equivalent internet-wide CIDR)
emit:
  source_type: NoSQLDatabase
  target_type: AnonymousIdentity
  source: ?instance
  target: <AnonymousIdentity>
  permissions: []
  conditions:
  - resource_policy
  - condition_expression
  derived_from:
  - resource_configuration(?instance)
  state_logic: "ACTIVE when: (a) the Neptune DB instance has PubliclyAccessible: true so its endpoint\
    \ resolves to a public IP, (b) the VPC security group allows inbound TCP on any Neptune protocol port\
    \ (8182 for Gremlin/openCypher HTTP, 8183 for SPARQL HTTP, or 8184 for Gremlin WebSocket) from 0.0.0.0/0\
    \ or ::/0, AND (c) the parent cluster has EnableIAMDatabaseAuthentication: false so requests are accepted\
    \ without SigV4 authentication. CONDITIONAL(condition_expression) when PubliclyAccessible is true\
    \ and any Neptune port is open but IAM authentication is enabled on the cluster \u2014 the endpoint\
    \ is publicly routed but SigV4 is required, so it is not anonymously accessible (broadly IAM-accessible).\
    \ BLOCKED if PubliclyAccessible is false (endpoint only resolves within the VPC) or all Neptune ports\
    \ are restricted to specific CIDRs (not truly internet-open)."
  false_positive_note: "PubliclyAccessible: true on the DB instance is a NECESSARY but not sufficient\
    \ condition \u2014 the VPC security group inbound rules must also allow at least one Neptune port\
    \ (8182, 8183, or 8184) from 0.0.0.0/0 or ::/0 for the cluster to be reachable from the internet.\
    \ Do not emit ACTIVE if all Neptune ports are restricted to specific CIDRs or VPC IDs; downgrade to\
    \ CONDITIONAL(network_reachability). Do not emit ACTIVE if EnableIAMDatabaseAuthentication is true\
    \ on the parent cluster \u2014 authentication is still required even with a public endpoint; use CONDITIONAL(condition_expression)\
    \ instead. Neptune uses port 8182 for Gremlin HTTP and WebSocket (legacy) and openCypher HTTP; port\
    \ 8183 for SPARQL HTTP; port 8184 for Gremlin WebSocket (modern). Evaluate security group inbound\
    \ rules for all three ports \u2014 a cluster is ExposedToInternet if any of these are open from 0.0.0.0/0.\
    \ Automated snapshots are not affected by this rule \u2014 this applies to live cluster endpoints\
    \ only."
  narrative: "Neptune DB instance {instance.name} (cluster {cluster.name}) is accessible from the public\
    \ internet without any authentication: its endpoint has a public IP (PubliclyAccessible: true), the\
    \ VPC security group allows inbound on one or more Neptune ports (8182, 8183, 8184) from 0.0.0.0/0,\
    \ and IAM database authentication is disabled \u2014 any internet host can issue Gremlin / openCypher\
    \ / SPARQL queries and read or write all graph data without credentials."