aws-qldb-partiqlhistory-read-data

id: aws-qldb-partiqlhistory-read-data
emits: CanReadData
description: qldb:PartiQLHistoryFunction (plus qldb:SendCommand as session gate) on a STANDARD-mode ledger's
  table allows the caller to read all document revisions (full version history) from that table, yielding
  data-plane read scoped to the individual table with higher impact than current-state-only reads.
match:
- - principal: null
  - HasPermission
  - table: null
where:
- node_type(?table) == NoSQLDatabase
- ?table.provider_type == 'AWS::QLDB::Table'
- effective_action(?principal, ?table) includes 'qldb:PartiQLHistoryFunction'
- effective_action(?principal, ledger_of(?table)) includes 'qldb:SendCommand'
- ledger_of(?table).properties.permissionsMode == 'STANDARD'
emit:
  source_type: Identity
  target_type: NoSQLDatabase
  source: ?principal
  target: ?table
  permissions:
  - qldb:PartiQLHistoryFunction
  - qldb:SendCommand
  conditions:
  - iam_permission
  - key_permission
  state_logic: "if effective 'qldb:PartiQLHistoryFunction' on ?table.arn AND effective 'qldb:SendCommand'\
    \ on the parent ledger ARN AND parent ledger permissionsMode == STANDARD:\n  if parent ledger encryptionDescription.kmsKeyArn\
    \ is customer-managed\n  (not 'AWS_OWNED_KMS_KEY'): CONDITIONAL(key_permission) \u2014 the QLDB service\n\
    \  (qldb.amazonaws.com, not the IAM caller) must have kms:Decrypt on the CMK\n  via a KMS grant in\
    \ the key policy. This is a service-level permission fact\n  collected from the KMS key policy, not\
    \ an IAM caller permission. Emit ACTIVE\n  when the KMS grant for qldb.amazonaws.com is confirmed;\
    \ emit CONDITIONAL(key_permission)\n  when unknown.\n  else: ACTIVE.\nelse: do not emit."
  confidence: contributing_confidence * 0.95
  derived_from:
  - <HasPermission edge for qldb:PartiQLHistoryFunction on ?table>
  - <HasPermission edge for qldb:SendCommand on parent ledger>
  false_positive_note: "Requires BOTH qldb:PartiQLHistoryFunction on the table ARN AND qldb:SendCommand\
    \ on the parent ledger ARN to be effective, AND the parent ledger must be in STANDARD mode. Honor\
    \ the exact resource scope: a grant of qldb:PartiQLHistoryFunction scoped to a wildcard ledger ARN\
    \ (arn:aws:qldb:*:*:ledger/*) covers all tables, but a grant scoped to a specific ledger ARN covers\
    \ only tables in that ledger. Table ARNs use the system-assigned tableId, not the table name \u2014\
    \ ensure the ARN in the permission matches the node being evaluated. This permission grants higher\
    \ impact than qldb:PartiQLSelect (which reads current state only) because it yields ALL document revisions\
    \ across the entire version history of the table. Do not emit for ALLOW_ALL ledgers (use aws-qldb-sendcommand-read-data\
    \ instead). For CMK-encrypted ledgers, emit CONDITIONAL(key_permission) when the KMS grant is unknown;\
    \ the relevant permission check is on the qldb.amazonaws.com service principal in the key policy,\
    \ not the IAM caller. Emit ACTIVE only when the KMS key policy is confirmed to grant kms:Decrypt to\
    \ qldb.amazonaws.com."
  narrative: '{principal.name} can read full revision history from {table.name} in {ledger.name} (qldb:PartiQLHistoryFunction
    on the table ARN + qldb:SendCommand on the ledger), accessing all document versions stored in that
    table across the entire version history. If {table.name} contains credentials or secrets, this yields
    further pivots via credential-chains:read-secret-yields-identity.'