aws-opensearch-fgac-master-user-reset-exposes
FGAC domain with internal user database exposes the master-user password to whoever can call es:UpdateDomainConfig.
match (effective permission)
{
"action": "es:UpdateDomainConfig",
"resource_type": "AWS::OpenSearchService::Domain"
}
where
?domain.AdvancedSecurityOptions.Enabled == true
?domain.AdvancedSecurityOptions.InternalUserDatabaseEnabled == true
emit
| source type | Data |
|---|---|
| target type | Secret |
| source | <OpenSearch domain (SearchService)> |
| target | <internal master-user password (Password node)> |
| permissions | es:UpdateDomainConfig |
| conditions | iam_permission |
| state logic | ACTIVE when the domain runs FGAC with InternalUserDatabaseEnabled (so an internal master-user password exists that can be reset). The domain itself exposes the credential to whoever controls UpdateDomainConfig. |
Narrative
OpenSearch domain {domain.name} exposes its internal master-user password to any principal with es:UpdateDomainConfig, since the password can be reset to an attacker-chosen value via the UpdateDomainConfig API.
Raw rule rules/derived/aws/opensearch.yaml
id: aws-opensearch-fgac-master-user-reset-exposes
emits: ExposesCredential
description: FGAC domain with internal user database exposes the master-user password to whoever can call
es:UpdateDomainConfig.
match_effective_permission:
action: es:UpdateDomainConfig
resource_type: AWS::OpenSearchService::Domain
where:
- ?domain.AdvancedSecurityOptions.Enabled == true
- ?domain.AdvancedSecurityOptions.InternalUserDatabaseEnabled == true
emit:
source_type: Data
target_type: Secret
source: <OpenSearch domain (SearchService)>
target: <internal master-user password (Password node)>
permissions:
- es:UpdateDomainConfig
conditions:
- iam_permission
state_logic: ACTIVE when the domain runs FGAC with InternalUserDatabaseEnabled (so an internal master-user
password exists that can be reset). The domain itself exposes the credential to whoever controls UpdateDomainConfig.
narrative: OpenSearch domain {domain.name} exposes its internal master-user password to any principal
with es:UpdateDomainConfig, since the password can be reset to an attacker-chosen value via the UpdateDomainConfig
API.