aws-rds-data-api-execute

rds-data:ExecuteStatement on an Aurora cluster (Serverless v1/v2 or provisioned with HttpEndpointEnabled) allows IAM-authenticated SQL execution via the RDS Data API - no DB client, VPC foothold, or static password required.

derived aws emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'db': None}

where

node_type(?db) == RelationalDatabase ?db.provider_type == 'AWS::RDS::DBCluster' ?db.properties.Engine in ['aurora-mysql', 'aurora-postgresql', 'aurora'] (?db.properties.EngineMode == 'serverless' OR ?db.properties.ServerlessV2ScalingConfiguration is not null OR (?db.properties.EngineMode is null AND ?db.properties.Engine in ['aurora-mysql', 'aurora-postgresql'])) ?db.properties.HttpEndpointEnabled == true # Data API must be explicitly enabled ?principal has EFFECTIVE rds-data:ExecuteStatement on ?db ARN

emit

source type	`Identity`
target type	`RelationalDatabase`
source	`?principal`
target	`?db`
permissions	`rds-data:ExecuteStatement`
conditions	`iam_permission` `scp_or_org_policy` `service_state`
state logic	ACTIVE when rds-data:ExecuteStatement is confirmed EFFECTIVE on the cluster ARN, the cluster's HttpEndpointEnabled is true, and the cluster is in AVAILABLE state (Aurora Serverless auto-pauses when idle; a paused cluster resumes automatically on the first Data API call, so pause state does NOT block the capability — emit ACTIVE and note auto-resume). Provisioned Aurora clusters with HttpEndpointEnabled are always available unless explicitly stopped. CONDITIONAL(iam_permission) when an SCP may restrict rds-data:ExecuteStatement but hasn't been resolved. CONDITIONAL(key_permission) when the cluster's associated Secrets Manager secret (if present) is KMS-encrypted and the principal lacks or has unresolved kms:Decrypt on the wrapping key — the CMK decrypt gate applies to both serverless and provisioned Data API configurations that use secrets. BLOCKED when an SCP or permission boundary explicitly denies rds-data:ExecuteStatement.

Narrative

{principal.name} can submit SQL queries to {db.name} via the RDS Data API (rds-data:ExecuteStatement + Data API enabled), reading and modifying data accessible to the mapped DB user - no VPC foothold or DB client required, only IAM authentication.

Raw rule rules/derived/aws/rds.yaml

id: aws-rds-data-api-execute
emits: CanReadData
description: "rds-data:ExecuteStatement on an Aurora cluster (Serverless v1/v2 or provisioned with HttpEndpointEnabled)\
  \ allows IAM-authenticated SQL execution via the RDS Data API \u2014 no DB client, VPC foothold, or\
  \ static password required."
match:
- - principal: null
  - HasPermission
  - db: null
where:
- node_type(?db) == RelationalDatabase
- ?db.provider_type == 'AWS::RDS::DBCluster'
- ?db.properties.Engine in ['aurora-mysql', 'aurora-postgresql', 'aurora']
- (?db.properties.EngineMode == 'serverless' OR ?db.properties.ServerlessV2ScalingConfiguration is not
  null OR (?db.properties.EngineMode is null AND ?db.properties.Engine in ['aurora-mysql', 'aurora-postgresql']))
- '?db.properties.HttpEndpointEnabled == true  # Data API must be explicitly enabled'
- ?principal has EFFECTIVE rds-data:ExecuteStatement on ?db ARN
emit:
  source_type: Identity
  target_type: RelationalDatabase
  source: ?principal
  target: ?db
  permissions:
  - rds-data:ExecuteStatement
  conditions:
  - iam_permission
  - scp_or_org_policy
  - service_state
  state_logic: "ACTIVE when rds-data:ExecuteStatement is confirmed EFFECTIVE on the cluster ARN, the cluster's\
    \ HttpEndpointEnabled is true, and the cluster is in AVAILABLE state (Aurora Serverless auto-pauses\
    \ when idle; a paused cluster resumes automatically on the first Data API call, so pause state does\
    \ NOT block the capability \u2014 emit ACTIVE and note auto-resume). Provisioned Aurora clusters with\
    \ HttpEndpointEnabled are always available unless explicitly stopped. CONDITIONAL(iam_permission)\
    \ when an SCP may restrict rds-data:ExecuteStatement but hasn't been resolved. CONDITIONAL(key_permission)\
    \ when the cluster's associated Secrets Manager secret (if present) is KMS-encrypted and the principal\
    \ lacks or has unresolved kms:Decrypt on the wrapping key \u2014 the CMK decrypt gate applies to both\
    \ serverless and provisioned Data API configurations that use secrets. BLOCKED when an SCP or permission\
    \ boundary explicitly denies rds-data:ExecuteStatement."
  confidence: min(contributing_confidences) * 0.90
  derived_from:
  - ?principal HasPermission ?db (rds-data:ExecuteStatement effective permission + HttpEndpointEnabled
    confirmed)
  false_positive_note: "The RDS Data API is available for Aurora Serverless v1 (EngineMode=serverless),\
    \ Aurora Serverless v2 (EngineMode=provisioned with ServerlessV2ScalingConfiguration), and provisioned\
    \ Aurora clusters (aurora-mysql, aurora-postgresql) as of late 2024. Standard RDS (non-Aurora) does\
    \ NOT support the Data API. HttpEndpointEnabled must be explicitly true (off by default for Aurora\
    \ Serverless v2 and provisioned Aurora; always verify the property). For all Aurora Data API configurations\
    \ that use a Secrets Manager secret containing database credentials, the principal must have kms:Decrypt\
    \ on any wrapping CMK \u2014 CONDITIONAL(key_permission) applies in that case. Aurora Serverless v1\
    \ clusters that are paused auto-resume on the first Data API call (up to several seconds delay); this\
    \ is not a blocking gate. Provisioned Aurora clusters with Data API enabled are always available unless\
    \ explicitly stopped. Scope the rule to Aurora engines (aurora-mysql, aurora-postgresql) only."
  narrative: "{principal.name} can submit SQL queries to {db.name} via the RDS Data API (rds-data:ExecuteStatement\
    \ + Data API enabled), reading and modifying data accessible to the mapped DB user \u2014 no VPC foothold\
    \ or DB client required, only IAM authentication."