aws-neptune-snapshot-public-exposed

Neptune cluster snapshot with public restore attribute (restore=all) is exposed to the internet via CrossAccountTrust to external Account.

derived aws emits ExposedToInternet

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Snapshot`
target type	`AnonymousIdentity`
source	`?snapshot`
target	`<AnonymousIdentity>`
state logic	ACTIVE because the snapshot has a public restore permission (CrossAccountTrust to external Account, meaning any AWS account). Any AWS account can call rds:RestoreDBClusterFromSnapshot to create a full copy of the graph data without credentials or further action. External Account trust on a public resource implies internet exposure.

source type

Snapshot

target type

AnonymousIdentity

source

?snapshot

target

<AnonymousIdentity>

state logic

ACTIVE because the snapshot has a public restore permission (CrossAccountTrust to external Account, meaning any AWS account). Any AWS account can call rds:RestoreDBClusterFromSnapshot to create a full copy of the graph data without credentials or further action. External Account trust on a public resource implies internet exposure.

Narrative

Neptune cluster snapshot {snapshot.name} is publicly restorable (AttributeValues contains 'all') - any AWS account can call rds:RestoreDBClusterFromSnapshot to create a full copy of all graph data (vertices, edges, properties) without the owner's involvement.

Raw rule rules/derived/aws/neptune.yaml

id: aws-neptune-snapshot-public-exposed
emits: ExposedToInternet
description: Neptune cluster snapshot with public restore attribute (restore=all) is exposed to the internet
  via CrossAccountTrust to external Account.
match:
- - snapshot: null
  - CrossAccountTrust
  - account: null
where:
- node_type(?snapshot) == Snapshot
- node_type(?account) == Account
- ?snapshot.SnapshotType == 'manual' OR ?snapshot source is from aws-neptune-snapshot-public-exposed-explicit
  rule
emit:
  source_type: Snapshot
  target_type: AnonymousIdentity
  source: ?snapshot
  target: <AnonymousIdentity>
  permissions: []
  conditions: []
  derived_from:
  - CrossAccountTrust(?snapshot, ?account)
  state_logic: ACTIVE because the snapshot has a public restore permission (CrossAccountTrust to external
    Account, meaning any AWS account). Any AWS account can call rds:RestoreDBClusterFromSnapshot to create
    a full copy of the graph data without credentials or further action. External Account trust on a public
    resource implies internet exposure.
  narrative: "Neptune cluster snapshot {snapshot.name} is publicly restorable (AttributeValues contains\
    \ 'all') \u2014 any AWS account can call rds:RestoreDBClusterFromSnapshot to create a full copy of\
    \ all graph data (vertices, edges, properties) without the owner's involvement."