rage.fail

aws-redshift-managed-admin-password-secret

explicit aws emits ContainsSecret

match (record)

{ "field": "MasterPasswordSecretArn", "resource_type": "AWS::Redshift::Cluster" }

where

MasterPasswordSecretArn is non-empty

emit

source type	`Data`
target type	`Secret`
source	`<Redshift Cluster (DataWarehouse node)>`
target	`<Secrets Manager secret at MasterPasswordSecretArn>`

Narrative

{cluster.name} stores its master (admin) database password in Secrets Manager secret {secret.name} via the ManagedAdminPassword integration. A principal with secretsmanager:GetSecretValue on this secret ARN can retrieve the plaintext admin password and authenticate to the cluster as the database superuser.

Raw rule rules/explicit/aws-redshift.yaml

id: aws-redshift-managed-admin-password-secret
emits: ContainsSecret
match_record:
  resource_type: AWS::Redshift::Cluster
  field: MasterPasswordSecretArn
where:
- MasterPasswordSecretArn is non-empty
emit:
  source_type: Data
  target_type: Secret
  source: <Redshift Cluster (DataWarehouse node)>
  target: <Secrets Manager secret at MasterPasswordSecretArn>
  api_source: redshift:DescribeClusters
  evidence_field: MasterPasswordSecretArn
  state: ACTIVE
  narrative: '{cluster.name} stores its master (admin) database password in Secrets Manager secret {secret.name}
    via the ManagedAdminPassword integration. A principal with secretsmanager:GetSecretValue on this secret
    ARN can retrieve the plaintext admin password and authenticate to the cluster as the database superuser.'