aws-redshift-admin-secret-read

A principal with secretsmanager:GetSecretValue on the Redshift ManagedAdminPassword secret can retrieve the plaintext admin DB password and connect as superuser, reading all warehouse data.

derived aws emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanReadSecret {'secret': None} {'cluster': None} ContainsSecret {'secret': None}

where

node_type(?cluster) == DataWarehouse ?cluster.provider_type in ['AWS::Redshift::Cluster', 'AWS::RedshiftServerless::Namespace'] ?secret.provider_type == 'AWS::SecretsManager::Secret' ?secret models the MasterPasswordSecretArn or adminPasswordSecretArn

emit

source type	`Identity`
target type	`Data`
source	`?principal`
target	`?cluster`
permissions	`secretsmanager:GetSecretValue`
conditions	`iam_permission` `service_state`
state logic	ACTIVE when secretsmanager:GetSecretValue is confirmed EFFECTIVE on the secret ARN AND the cluster is AVAILABLE (not paused). CONDITIONAL(service_state) when the cluster is paused. CONDITIONAL(iam_permission) when an SCP or boundary may restrict GetSecretValue but is unresolved. BLOCKED by explicit SCP deny on secretsmanager:GetSecretValue. The returned admin password grants DB superuser access, which is the highest privilege within the database.

Narrative

{principal.name} can retrieve the admin database password for {cluster.name} from its Secrets Manager secret (secretsmanager:GetSecretValue). Using that password, {principal.name} can connect directly as a database superuser and read all tables, perform administrative changes, or export warehouse data.

Raw rule rules/derived/aws/redshift.yaml

id: aws-redshift-admin-secret-read
emits: CanReadData
description: A principal with secretsmanager:GetSecretValue on the Redshift ManagedAdminPassword secret
  can retrieve the plaintext admin DB password and connect as superuser, reading all warehouse data.
match:
- - principal: null
  - CanReadSecret
  - secret: null
- - cluster: null
  - ContainsSecret
  - secret: null
where:
- node_type(?cluster) == DataWarehouse
- ?cluster.provider_type in ['AWS::Redshift::Cluster', 'AWS::RedshiftServerless::Namespace']
- ?secret.provider_type == 'AWS::SecretsManager::Secret'
- ?secret models the MasterPasswordSecretArn or adminPasswordSecretArn
emit:
  source_type: Identity
  target_type: Data
  source: ?principal
  target: ?cluster
  permissions:
  - secretsmanager:GetSecretValue
  conditions:
  - iam_permission
  - service_state
  state_logic: ACTIVE when secretsmanager:GetSecretValue is confirmed EFFECTIVE on the secret ARN AND
    the cluster is AVAILABLE (not paused). CONDITIONAL(service_state) when the cluster is paused. CONDITIONAL(iam_permission)
    when an SCP or boundary may restrict GetSecretValue but is unresolved. BLOCKED by explicit SCP deny
    on secretsmanager:GetSecretValue. The returned admin password grants DB superuser access, which is
    the highest privilege within the database.
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - ?principal CanReadSecret ?secret (secretsmanager:GetSecretValue)
  - ?cluster ContainsSecret ?secret (MasterPasswordSecretArn / adminPasswordSecretArn explicit edge)
  - credential-chains:read-secret-yields-identity linchpin (secret stores admin DB credential)
  false_positive_note: "The secret must be encrypted at rest. If wrapped by a CMK, the principal must\
    \ also have kms:Decrypt \u2014 without it, GetSecretValue fails (CONDITIONAL(key_permission)). The\
    \ credential retrieved is the master/admin database password; it authenticates directly to the database\
    \ (superuser), not via IAM auth. Redshift ManagedAdminPassword auto-rotates but does not invalidate\
    \ prior password versions for 2 hours by default. Network reachability still required: if the cluster\
    \ is not publicly accessible, the principal must be in the VPC or use PrivateLink."
  narrative: '{principal.name} can retrieve the admin database password for {cluster.name} from its Secrets
    Manager secret (secretsmanager:GetSecretValue). Using that password, {principal.name} can connect
    directly as a database superuser and read all tables, perform administrative changes, or export warehouse
    data.'