rage.fail

aws-ssm-params-exposes-credential

A SecureString parameter exposes credential material to any reader.

derived aws emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'param': None} ContainsSecret {'secret': None}

where

node_class(?param) == Secret ?param.origin_service == aws:ssm-params ?param.parameter_type == SecureString credential_bucket(?secret) == Credential # subtype in {Credential,Password,APIKey,AccessKey,Token,ConnectionString,Certificate}

emit

source	`?param`
target	`?secret`
state logic	ACTIVE — expresses that reading the SecureString equals holding the credential

Narrative

{param.name} exposes the credential material it stores to any principal able to read it.

Raw rule rules/derived/aws/ssm-params.yaml

id: aws-ssm-params-exposes-credential
emits: ExposesCredential
description: A SecureString parameter exposes credential material to any reader.
match:
- - param: null
  - ContainsSecret
  - secret: null
where:
- node_class(?param) == Secret
- ?param.origin_service == aws:ssm-params
- ?param.parameter_type == SecureString
- 'credential_bucket(?secret) == Credential  # subtype in {Credential,Password,APIKey,AccessKey,Token,ConnectionString,Certificate}'
emit:
  source: ?param
  target: ?secret
  permissions: []
  conditions: []
  state_logic: "ACTIVE \u2014 expresses that reading the SecureString equals holding the credential"
  confidence: min(contributing_confidences)
  derived_from:
  - <ContainsSecret edge_id>
  false_positive_note: Not an escalation by itself; it states that a reader of this SecureString holds
    the credential it contains. Path value comes from a contributing CanReadSecret. Do not emit for String/StringList
    parameters. Do not emit when ?secret's subtype is the generic 'Secret'/'GenericSecret' (a Secret-class
    node), since that is not in ExposesCredential's [Credential, Identity] target set.
  narrative: '{param.name} exposes the credential material it stores to any principal able to read it.'