aws-redshift-public-cluster

id: aws-redshift-public-cluster
emits: ExposedToInternet
description: A Redshift cluster or Serverless workgroup with PubliclyAccessible=true and a permissive
  VPC security group is reachable from the public internet on port 5439.
match:
- - cluster: null
  - ExposedToInternet
  - anon: null
where:
- node_type(?cluster) == DataWarehouse
- ?cluster.provider_type in ['AWS::Redshift::Cluster', 'AWS::RedshiftServerless::Workgroup']
- ?cluster.properties.PubliclyAccessible == true
- ?cluster.properties.VpcSecurityGroups[].rules allows inbound on TCP port 5439 from 0.0.0.0/0 or ::/0
  or CIDR includes attacker source
emit:
  source_type: Data
  target_type: AnonymousIdentity
  source: ?cluster
  target: <AnonymousIdentity>
  permissions: []
  conditions:
  - network_reachability
  - service_state
  state_logic: "ACTIVE when PubliclyAccessible=true is confirmed AND the cluster's VPC security group\
    \ allows inbound TCP port 5439 from 0.0.0.0/0 or a sufficiently broad CIDR (practically internet-accessible).\
    \ CONDITIONAL(network_reachability) when PubliclyAccessible=true but the SG limits inbound to specific\
    \ CIDRs \u2014 only hosts in those CIDRs can reach the cluster, not the general internet; downgrade\
    \ to CONDITIONAL. CONDITIONAL(service_state) when the cluster is paused/not available. BLOCKED when\
    \ PubliclyAccessible=false or an NACl/SG deny blocks port 5439. Valid credentials are still required\
    \ to authenticate \u2014 the cluster being public does not grant data access, only network reachability."
  confidence: min(contributing_confidences)
  derived_from:
  - ExposedToInternet (explicit edge from aws-redshift-cluster-publicly-accessible or aws-redshift-serverless-workgroup-publicly-accessible)
  - ?cluster.properties.PubliclyAccessible == true
  - ?cluster.properties.VpcSecurityGroups[].rules allows inbound TCP 5439
  false_positive_note: "PubliclyAccessible=true alone is NOT sufficient for ExposedToInternet ACTIVE:\
    \ the VPC security group MUST also permit inbound port 5439 from the internet (0.0.0.0/0 or broad\
    \ CIDR). A cluster with PubliclyAccessible=true but SG restricted to a specific corporate IP range\
    \ is NOT internet-exposed in the broad sense \u2014 remain CONDITIONAL(network_reachability). This\
    \ edge indicates network reachability only; exploiting it still requires valid DB credentials or an\
    \ IAM-auth path. Serverless workgroups have a separate `publiclyAccessible` flag on the workgroup;\
    \ apply the same SG check. NACLs (subnet-level) also apply \u2014 honor them if collected."
  narrative: '{cluster.name} is accessible from the public internet (PubliclyAccessible=true + VPC SG
    open on port 5439). An attacker with valid credentials (temporary DB password, IAM-auth session) can
    connect and query data without needing a VPC foothold.'