aws-quicksight-update-datasource-cred-overwrite
quicksight:UpdateDataSource on a data source with stored credentials lets an attacker overwrite those credentials or change the endpoint, triggering credential exfiltration or database takeover.
match (effective permission)
{
"action": "quicksight:UpdateDataSource",
"resource_type": "AWS::QuickSight::DataSource"
}
where
?datasource is an existing
GenericData node with provider_type AWS::QuickSight::DataSource
?datasource has a ContainsSecret edge (stored credentials exist)
?datasource.credential_type in ['USERNAME_PASSWORD', 'API_KEY', 'CREDENTIAL_PAIR']
emit
| source type | Identity |
|---|---|
| target type | Data |
| source | <principal with quicksight:UpdateDataSource> |
| target | ?datasource |
| permissions | quicksight:UpdateDataSource |
| conditions | iam_permission service_state |
| state logic | ACTIVE when principal has quicksight:UpdateDataSource and the data source is in CREATION_SUCCESSFUL state with stored credentials (ContainsSecret edge exists). CONDITIONAL(service_state) when data source status is uncollected/unknown. BLOCKED if SCP denies quicksight:UpdateDataSource. |
Narrative
{principal.name} can update QuickSight data source {datasource.name} (quicksight:UpdateDataSource), potentially overwriting its stored credentials {credential_type} or replacing the endpoint to exfiltrate credentials to an attacker-controlled host.
Raw rule rules/derived/aws/quicksight.yaml
id: aws-quicksight-update-datasource-cred-overwrite
emits: CanModify
description: quicksight:UpdateDataSource on a data source with stored credentials lets an attacker overwrite
those credentials or change the endpoint, triggering credential exfiltration or database takeover.
match_effective_permission:
action: quicksight:UpdateDataSource
resource_type: AWS::QuickSight::DataSource
where:
- ?datasource is an existing GenericData node with provider_type AWS::QuickSight::DataSource
- ?datasource has a ContainsSecret edge (stored credentials exist)
- ?datasource.credential_type in ['USERNAME_PASSWORD', 'API_KEY', 'CREDENTIAL_PAIR']
emit:
source_type: Identity
target_type: Data
source: <principal with quicksight:UpdateDataSource>
target: ?datasource
permissions:
- quicksight:UpdateDataSource
conditions:
- iam_permission
- service_state
state_logic: ACTIVE when principal has quicksight:UpdateDataSource and the data source is in CREATION_SUCCESSFUL
state with stored credentials (ContainsSecret edge exists). CONDITIONAL(service_state) when data source
status is uncollected/unknown. BLOCKED if SCP denies quicksight:UpdateDataSource.
confidence: min(contributing_confidences) * 0.85
derived_from: []
false_positive_note: This models CanModify on the data source itself, not direct credential exfiltration.
The attacker's ability to exfiltrate via endpoint replacement is modeled separately; CanModify(principal,
DataSource) combined with ExposesCredential(DataSource, Credential) allows downstream inference of
credential exposure. Only emits for data sources with stored credentials (not IAM-credential types).
narrative: '{principal.name} can update QuickSight data source {datasource.name} (quicksight:UpdateDataSource),
potentially overwriting its stored credentials {credential_type} or replacing the endpoint to exfiltrate
credentials to an attacker-controlled host.'