aws-opensearch-fgac-master-user-reset
A principal with es:UpdateDomainConfig on a FGAC domain with internal user database can reset and effectively read the master-user password.
match (effective permission)
{
"action": "es:UpdateDomainConfig",
"resource_type": "AWS::OpenSearchService::Domain"
}
where
?domain.AdvancedSecurityOptions.Enabled == true
?domain.AdvancedSecurityOptions.InternalUserDatabaseEnabled == true
emit
| source type | Identity |
|---|---|
| target type | Secret |
| source | <principal> |
| target | <internal master-user password (Password node)> |
| permissions | es:UpdateDomainConfig |
| conditions | iam_permission |
| state logic | ACTIVE when the principal has effective es:UpdateDomainConfig on the domain ARN AND the domain runs FGAC with InternalUserDatabaseEnabled. The principal can reset (and thus read/know) the password. BLOCKED if an SCP or IAM boundary denies es:UpdateDomainConfig. CONDITIONAL(service_state) if the domain is in a non-ACTIVE state where UpdateDomainConfig calls are rejected. |
Narrative
{principal.name} can reset the internal master-user password for OpenSearch domain {domain.name} (es:UpdateDomainConfig) because FGAC runs with an internal user database; setting a known password gives the attacker full cluster admin access (create/delete indices, modify role mappings, read all data) as the internal master user.
Raw rule rules/derived/aws/opensearch.yaml
id: aws-opensearch-fgac-master-user-reset
emits: CanReadSecret
description: A principal with es:UpdateDomainConfig on a FGAC domain with internal user database can reset
and effectively read the master-user password.
match_effective_permission:
action: es:UpdateDomainConfig
resource_type: AWS::OpenSearchService::Domain
where:
- ?domain.AdvancedSecurityOptions.Enabled == true
- ?domain.AdvancedSecurityOptions.InternalUserDatabaseEnabled == true
emit:
source_type: Identity
target_type: Secret
source: <principal>
target: <internal master-user password (Password node)>
permissions:
- es:UpdateDomainConfig
conditions:
- iam_permission
state_logic: ACTIVE when the principal has effective es:UpdateDomainConfig on the domain ARN AND the
domain runs FGAC with InternalUserDatabaseEnabled. The principal can reset (and thus read/know) the
password. BLOCKED if an SCP or IAM boundary denies es:UpdateDomainConfig. CONDITIONAL(service_state)
if the domain is in a non-ACTIVE state where UpdateDomainConfig calls are rejected.
false_positive_note: "Only emit when InternalUserDatabaseEnabled is true. If the master user is an IAM\
\ role (MasterUserARN set, InternalUserDatabaseEnabled false), UpdateDomainConfig cannot yield an\
\ internal password \u2014 the IAM role's own trust policy governs who can assume it. Do not model\
\ the IAM master-user ARN case as ExposesCredential; it is a CanAssume/CanModifyTrust path against\
\ the master IAM role. The password reset is not a READ of an existing credential \u2014 it is a SET\
\ of a new known value; model as both ExposesCredential (domain exposes) and CanReadSecret (principal\
\ can read) to complete the credential-chains linkage."
narrative: '{principal.name} can reset the internal master-user password for OpenSearch domain {domain.name}
(es:UpdateDomainConfig) because FGAC runs with an internal user database; setting a known password
gives the attacker full cluster admin access (create/delete indices, modify role mappings, read all
data) as the internal master user.'