aws-neptune-snapshot-public-exposed-explicit
Neptune cluster snapshot is publicly restorable (restore attribute contains 'all') via neptune:DescribeDBClusterSnapshotAttributes, establishing a CrossAccountTrust.
match (record)
{
"field": "DBClusterSnapshotAttributes[restore].AttributeValues",
"resource_type": "AWS::Neptune::DBClusterSnapshot"
}
where
AttributeValues contains 'all'
emit
| source type | Snapshot |
|---|---|
| target type | Account |
| source | <Neptune cluster snapshot (Snapshot)> |
| target | <external AWS account (representing all AWS accounts)> |
Narrative
Neptune cluster snapshot {snapshot.name} is publicly restorable (AttributeValues contains 'all') - any AWS account can call rds:RestoreDBClusterFromSnapshot to create a full copy of all graph data without the owner's involvement (complete data exfiltration).
Raw rule rules/explicit/aws-neptune.yaml
id: aws-neptune-snapshot-public-exposed-explicit
emits: CrossAccountTrust
applies_to:
- aws
description: Neptune cluster snapshot is publicly restorable (restore attribute contains 'all') via neptune:DescribeDBClusterSnapshotAttributes,
establishing a CrossAccountTrust.
match_record:
resource_type: AWS::Neptune::DBClusterSnapshot
field: DBClusterSnapshotAttributes[restore].AttributeValues
where:
- AttributeValues contains 'all'
emit:
source_type: Snapshot
target_type: Account
source: <Neptune cluster snapshot (Snapshot)>
target: <external AWS account (representing all AWS accounts)>
api_source: neptune:DescribeDBClusterSnapshotAttributes
evidence_field: DBClusterSnapshotAttributes[restore].AttributeValues == 'all'
narrative: "Neptune cluster snapshot {snapshot.name} is publicly restorable (AttributeValues contains\
\ 'all') \u2014 any AWS account can call rds:RestoreDBClusterFromSnapshot to create a full copy of\
\ all graph data without the owner's involvement (complete data exfiltration)."