aws-neptune-stream-read-data
Principal with neptune-db:connect and neptune-db:GetStreamRecords on the cluster resource ARN can read all graph mutations via Neptune Streams.
match (effective permission)
{
"action": [
"neptune-db:connect",
"neptune-db:GetStreamRecords"
],
"resource_type": "AWS::Neptune::DBCluster"
}
where
cluster.EnableIAMDatabaseAuthentication == true
emit
| source type | Identity |
|---|---|
| target type | NoSQLDatabase |
| source | <principal> |
| target | <Neptune cluster (NoSQLDatabase)> |
| permissions | neptune-db:connect neptune-db:GetStreamRecords |
| conditions | iam_permission network_reachability |
| state logic | ACTIVE when the principal's effective IAM permissions include both neptune-db:connect and neptune-db:GetStreamRecords on the cluster's neptune-db resource ARN AND the cluster has EnableIAMDatabaseAuthentication set to true AND network reach to the cluster endpoint is confirmed. BLOCKED if an SCP or IAM boundary denies either action. |
Narrative
{principal.name} has neptune-db:connect and neptune-db:GetStreamRecords on Neptune cluster {cluster.name}; with IAM database authentication enabled, {principal.name} can read all graph mutations via Neptune Streams (/propertygraph/stream or /sparql/stream), effectively accessing all historical graph data changes without direct query access.
Raw rule rules/derived/aws/neptune.yaml
id: aws-neptune-stream-read-data
emits: CanReadData
description: Principal with neptune-db:connect and neptune-db:GetStreamRecords on the cluster resource
ARN can read all graph mutations via Neptune Streams.
match_effective_permission:
action:
- neptune-db:connect
- neptune-db:GetStreamRecords
resource_type: AWS::Neptune::DBCluster
where:
- cluster.EnableIAMDatabaseAuthentication == true
emit:
source_type: Identity
target_type: NoSQLDatabase
source: <principal>
target: <Neptune cluster (NoSQLDatabase)>
permissions:
- neptune-db:connect
- neptune-db:GetStreamRecords
conditions:
- iam_permission
- network_reachability
derived_from:
- HasPermission(neptune-db:connect)
- HasPermission(neptune-db:GetStreamRecords)
state_logic: ACTIVE when the principal's effective IAM permissions include both neptune-db:connect and
neptune-db:GetStreamRecords on the cluster's neptune-db resource ARN AND the cluster has EnableIAMDatabaseAuthentication
set to true AND network reach to the cluster endpoint is confirmed. BLOCKED if an SCP or IAM boundary
denies either action.
false_positive_note: Neptune Streams access leaks ALL mutation history, not just the current graph state.
A principal with GetStreamRecords can reconstruct the entire evolution of the graph, including vertices/edges
since the stream retention window started (default 24 hours).
narrative: '{principal.name} has neptune-db:connect and neptune-db:GetStreamRecords on Neptune cluster
{cluster.name}; with IAM database authentication enabled, {principal.name} can read all graph mutations
via Neptune Streams (/propertygraph/stream or /sparql/stream), effectively accessing all historical
graph data changes without direct query access.'