aws-qldb-partiql-select-read-data

qldb:PartiQLSelect (plus qldb:SendCommand as session gate) on a STANDARD-mode ledger's table allows the caller to read all documents from that table, yielding data-plane read scoped to the individual table.

derived aws emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'table': None}

where

node_type(?table) == NoSQLDatabase ?table.provider_type == 'AWS::QLDB::Table' effective_action(?principal, ?table) includes 'qldb:PartiQLSelect' effective_action(?principal, ledger_of(?table)) includes 'qldb:SendCommand' ledger_of(?table).properties.permissionsMode == 'STANDARD'

emit

source type	`Identity`
target type	`NoSQLDatabase`
source	`?principal`
target	`?table`
permissions	`qldb:PartiQLSelect` `qldb:SendCommand`
conditions	`iam_permission` `key_permission`
state logic	if effective 'qldb:PartiQLSelect' on ?table.arn AND effective 'qldb:SendCommand' on the parent ledger ARN AND parent ledger permissionsMode == STANDARD: if parent ledger encryptionDescription.kmsKeyArn is customer-managed (not 'AWS_OWNED_KMS_KEY'): CONDITIONAL(key_permission) — the QLDB service (qldb.amazonaws.com, not the IAM caller) must have kms:Decrypt on the CMK via a KMS grant in the key policy. This is a service-level permission fact collected from the KMS key policy, not an IAM caller permission. Emit ACTIVE when the KMS grant for qldb.amazonaws.com is confirmed; emit CONDITIONAL(key_permission) when unknown. else: ACTIVE. else: do not emit.

Narrative

{principal.name} can SELECT documents from {table.name} in {ledger.name} (qldb:PartiQLSelect on the table ARN + qldb:SendCommand on the ledger), reading all current document revisions stored in that table. If {table.name} contains credentials or secrets, this yields further pivots via credential-chains:read-secret-yields-identity.

Raw rule rules/derived/aws/qldb.yaml

id: aws-qldb-partiql-select-read-data
emits: CanReadData
description: qldb:PartiQLSelect (plus qldb:SendCommand as session gate) on a STANDARD-mode ledger's table
  allows the caller to read all documents from that table, yielding data-plane read scoped to the individual
  table.
match:
- - principal: null
  - HasPermission
  - table: null
where:
- node_type(?table) == NoSQLDatabase
- ?table.provider_type == 'AWS::QLDB::Table'
- effective_action(?principal, ?table) includes 'qldb:PartiQLSelect'
- effective_action(?principal, ledger_of(?table)) includes 'qldb:SendCommand'
- ledger_of(?table).properties.permissionsMode == 'STANDARD'
emit:
  source_type: Identity
  target_type: NoSQLDatabase
  source: ?principal
  target: ?table
  permissions:
  - qldb:PartiQLSelect
  - qldb:SendCommand
  conditions:
  - iam_permission
  - key_permission
  state_logic: "if effective 'qldb:PartiQLSelect' on ?table.arn AND effective 'qldb:SendCommand' on the\
    \ parent ledger ARN AND parent ledger permissionsMode == STANDARD:\n  if parent ledger encryptionDescription.kmsKeyArn\
    \ is customer-managed\n  (not 'AWS_OWNED_KMS_KEY'): CONDITIONAL(key_permission) \u2014 the QLDB service\n\
    \  (qldb.amazonaws.com, not the IAM caller) must have kms:Decrypt on the CMK\n  via a KMS grant in\
    \ the key policy. This is a service-level permission fact\n  collected from the KMS key policy, not\
    \ an IAM caller permission. Emit ACTIVE\n  when the KMS grant for qldb.amazonaws.com is confirmed;\
    \ emit CONDITIONAL(key_permission)\n  when unknown.\n  else: ACTIVE.\nelse: do not emit."
  confidence: contributing_confidence * 0.95
  derived_from:
  - <HasPermission edge for qldb:PartiQLSelect on ?table>
  - <HasPermission edge for qldb:SendCommand on parent ledger>
  false_positive_note: "Requires BOTH qldb:PartiQLSelect on the table ARN AND qldb:SendCommand on the\
    \ parent ledger ARN to be effective, AND the parent ledger must be in STANDARD mode. Honor the exact\
    \ resource scope: a grant of qldb:PartiQLSelect scoped to a wildcard ledger ARN (arn:aws:qldb:*:*:ledger/*)\
    \ covers all tables, but a grant scoped to a specific ledger ARN covers only tables in that ledger.\
    \ Table ARNs use the system-assigned tableId, not the table name \u2014 ensure the ARN in the permission\
    \ matches the node being evaluated. Do not emit for ALLOW_ALL ledgers (use aws-qldb-sendcommand-read-data\
    \ instead). For CMK-encrypted ledgers, emit CONDITIONAL(key_permission) when the KMS grant is unknown;\
    \ the relevant permission check is on the qldb.amazonaws.com service principal in the key policy,\
    \ not the IAM caller. Emit ACTIVE only when the KMS key policy is confirmed to grant kms:Decrypt to\
    \ qldb.amazonaws.com."
  narrative: '{principal.name} can SELECT documents from {table.name} in {ledger.name} (qldb:PartiQLSelect
    on the table ARN + qldb:SendCommand on the ledger), reading all current document revisions stored
    in that table. If {table.name} contains credentials or secrets, this yields further pivots via credential-chains:read-secret-yields-identity.'