aws-redshift-get-cluster-credentials

id: aws-redshift-get-cluster-credentials
emits: CanReadCredential
description: redshift:GetClusterCredentials generates a temporary database username/password, enabling
  JDBC/ODBC authentication to the cluster as the requested DB user.
match:
- - principal: null
  - HasPermission
  - cluster: null
where:
- node_type(?cluster) == DataWarehouse
- ?cluster.provider_type in ['AWS::Redshift::Cluster']
- ?principal has EFFECTIVE redshift:GetClusterCredentials on ?cluster ARN
emit:
  source_type: Identity
  target_type: Credential
  source: ?principal
  target: <temporary DB credential for the requested DbUser on ?cluster>
  permissions:
  - redshift:GetClusterCredentials
  conditions:
  - iam_permission
  - condition_expression
  - service_state
  state_logic: 'ACTIVE when redshift:GetClusterCredentials is confirmed EFFECTIVE on the cluster ARN AND
    the IAM condition key redshift:DbUser (if present) admits the requested DB user. CONDITIONAL(condition_expression)
    when a redshift:DbUser condition exists that the attacker may not satisfy (e.g., scoped to a specific
    user that doesn''t exist or is not a superuser). CONDITIONAL(service_state) when the cluster is paused.
    BLOCKED by an explicit deny on redshift:GetClusterCredentials. Note: GetClusterCredentialsWithIAM
    (IAM identity-based) follows the same pattern but requires redshift:GetClusterCredentialsWithIAM instead.'
  confidence: min(contributing_confidences) * 0.90
  derived_from:
  - ?principal HasPermission ?cluster (redshift:GetClusterCredentials effective permission)
  false_positive_note: "The IAM condition key redshift:DbUser controls which DB user the credential maps\
    \ to; without a DbUser condition, the principal can request credentials for ANY DB user including\
    \ the admin superuser. If a DbUser condition is present and scopes to a non-privileged user, the generated\
    \ credential has limited DB access \u2014 CONDITIONAL(condition_expression). The cluster must be reachable\
    \ (network: VPC SG port 5439 or PubliclyAccessible=true for external connections). A credential for\
    \ the 'awsuser' (admin) superuser is significantly higher value than a credential for a read-only\
    \ reporting user. Model DB user privilege in the target Credential node's properties. GetClusterCredentialsWithIAM\
    \ (no separate DbUser param) maps to the caller's IAM identity mapped DB user \u2014 check the identity's\
    \ Redshift DB-user mapping."
  narrative: '{principal.name} can generate a temporary Redshift database password for {cluster.name}
    (redshift:GetClusterCredentials), enabling direct JDBC/ODBC connection as the requested DB user. If
    the DB user is a superuser, this grants full warehouse control.'