aws-rds-iam-db-auth-connect

rds-db:connect on a DB user ARN grants IAM database authentication - the principal can generate a 15-minute token to connect as the mapped DB user without a static password.

derived aws emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'db': None}

where

node_type(?db) == RelationalDatabase ?db.provider_type in ['AWS::RDS::DBInstance', 'AWS::RDS::DBCluster'] ?db.properties.IAMDatabaseAuthenticationEnabled == true ?principal has EFFECTIVE rds-db:connect on ?db ARN (or on a matching db-user resource ARN scoped to ?db)

emit

source type	`Identity`
target type	`RelationalDatabase`
source	`?principal`
target	`?db`
permissions	`rds-db:connect`
conditions	`iam_permission` `condition_expression` `service_state` `network_reachability`
state logic	ACTIVE when rds-db:connect is confirmed EFFECTIVE (IAM principal policy grants rds-db:connect on a resource ARN matching ?db's db-resource-id for at least one DB user) AND IAMDatabaseAuthenticationEnabled is true on ?db AND the DB is AVAILABLE. CONDITIONAL(service_state) when the DB is STOPPED or in maintenance. CONDITIONAL(network_reachability) when the DB is VPC-private (not PubliclyAccessible) and the principal has no confirmed VPC foothold — the credential is obtainable but unusable without connectivity. CONDITIONAL(condition_expression) when the rds-db:connect resource ARN scopes to a non-privileged DB user (analyst should note the user's privilege level). BLOCKED when an SCP or permission boundary denies rds-db:connect.

Narrative

{principal.name} has rds-db:connect permission on {db.name}'s IAM DB auth resource ARN, allowing it to generate a 15-minute authentication token and connect to {db.name} as the mapped DB user. If the mapped user is a superuser or has broad GRANT privileges, this yields full database access.

Raw rule rules/derived/aws/rds.yaml

id: aws-rds-iam-db-auth-connect
emits: CanReadData
description: "rds-db:connect on a DB user ARN grants IAM database authentication \u2014 the principal\
  \ can generate a 15-minute token to connect as the mapped DB user without a static password."
match:
- - principal: null
  - HasPermission
  - db: null
where:
- node_type(?db) == RelationalDatabase
- ?db.provider_type in ['AWS::RDS::DBInstance', 'AWS::RDS::DBCluster']
- ?db.properties.IAMDatabaseAuthenticationEnabled == true
- ?principal has EFFECTIVE rds-db:connect on ?db ARN (or on a matching db-user resource ARN scoped to
  ?db)
emit:
  source_type: Identity
  target_type: RelationalDatabase
  source: ?principal
  target: ?db
  permissions:
  - rds-db:connect
  conditions:
  - iam_permission
  - condition_expression
  - service_state
  - network_reachability
  state_logic: "ACTIVE when rds-db:connect is confirmed EFFECTIVE (IAM principal policy grants rds-db:connect\
    \ on a resource ARN matching ?db's db-resource-id for at least one DB user) AND IAMDatabaseAuthenticationEnabled\
    \ is true on ?db AND the DB is AVAILABLE. CONDITIONAL(service_state) when the DB is STOPPED or in\
    \ maintenance. CONDITIONAL(network_reachability) when the DB is VPC-private (not PubliclyAccessible)\
    \ and the principal has no confirmed VPC foothold \u2014 the credential is obtainable but unusable\
    \ without connectivity. CONDITIONAL(condition_expression) when the rds-db:connect resource ARN scopes\
    \ to a non-privileged DB user (analyst should note the user's privilege level). BLOCKED when an SCP\
    \ or permission boundary denies rds-db:connect."
  confidence: min(contributing_confidences) * 0.90
  derived_from:
  - ?principal HasPermission ?db (rds-db:connect effective permission + IAMDatabaseAuthenticationEnabled
    confirmed)
  false_positive_note: "Two prerequisites beyond the IAM permission: (1) IAMDatabaseAuthenticationEnabled\
    \ must be true on the DB instance/cluster \u2014 if it is false, the generated token is rejected by\
    \ the DB engine. (2) The DB engine must EXIST as a DB user with the same name as the caller (IAM DB\
    \ auth maps the IAM identity or the resource-ARN db-user segment to a DB-internal user; if the DB\
    \ user does not exist, authentication fails). The resource ARN format is: arn:aws:rds-db:<region>:<account>:dbuser:<db-resource-id>/<db-user-name>\
    \ A wildcard (*) in the db-user-name position lets the principal connect as ANY DB user including\
    \ the master user. A specific db-user-name scopes to one user. Network reachability gates actual exploitation\
    \ for VPC-private DBs: the IAM permission alone is not sufficient to connect. Score CONDITIONAL(network_reachability)\
    \ for private DBs unless a VPC foothold is confirmed."
  narrative: '{principal.name} has rds-db:connect permission on {db.name}''s IAM DB auth resource ARN,
    allowing it to generate a 15-minute authentication token and connect to {db.name} as the mapped DB
    user. If the mapped user is a superuser or has broad GRANT privileges, this yields full database access.'