aws-ssm-params-securestring-credentials-for
A SecureString parameter's value authenticates as the target identity/service.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
{'param': None}
ContainsSecret {'secret': None}
{'secret': None} ContainsResourceReference {'target': None}
where
node_class(?param) ==
Secret
?param.origin_service == aws:ssm-params
?param.parameter_type == SecureString
node_class(?target) in [Identity, Data]
the ContainsResourceReference carries a credential-resolution signal (name/tag/description heuristic e.g. password|db|api-key|token|/rds/, or a resolved IaC/connection-string reference); signal_strength scales confidence
emit
| source | ?param |
|---|---|
| target | ?target |
| state logic | ACTIVE (zero-cost fact once the value is read); confidence scaled by signal strength |
Narrative
The SecureString {param.name} holds a credential for {target.name}; reading it lets the holder authenticate as {target.name}.
Raw rule rules/derived/aws/ssm-params.yaml
id: aws-ssm-params-securestring-credentials-for
emits: CredentialsFor
description: A SecureString parameter's value authenticates as the target identity/service.
match:
- - param: null
- ContainsSecret
- secret: null
- - secret: null
- ContainsResourceReference
- target: null
where:
- node_class(?param) == Secret
- ?param.origin_service == aws:ssm-params
- ?param.parameter_type == SecureString
- node_class(?target) in [Identity, Data]
- the ContainsResourceReference carries a credential-resolution signal (name/tag/description heuristic
e.g. password|db|api-key|token|/rds/, or a resolved IaC/connection-string reference); signal_strength
scales confidence
emit:
source: ?param
target: ?target
permissions: []
conditions: []
state_logic: ACTIVE (zero-cost fact once the value is read); confidence scaled by signal strength
confidence: 0.6 * signal_strength
derived_from:
- <ContainsSecret edge_id>
- <ContainsResourceReference edge_id>
note: "Nature deviation (documented, per lambda.yaml's CreateFunction~CanDeploy fold): CredentialsFor\
\ is nature: explicit in schema/edges.yaml, but this instance is a HEURISTIC derivation \u2014 the\
\ target binding depends on a name/tag/description signal or a resolved reference, not on a directly\
\ observed authentication record. It therefore lives in the derived file at reduced confidence. When\
\ a reference is resolved with high certainty (e.g. a connection string naming an RDS instance), the\
\ same edge may instead be emitted by the explicit normalizer; graph consumers keying strictly on\
\ explicit CredentialsFor should also accept this derived one."
false_positive_note: "Requires a concrete ContainsResourceReference binding from the SecureString to\
\ ?target \u2014 never assert a specific target from a bare SecureString or from prose. With only\
\ a weak/absent signal (no ContainsResourceReference), prefer the generic aws-ssm-params-exposes-credential\
\ (ExposesCredential) instead of a targeted CredentialsFor. This edge is zero-cost for path-finding;\
\ its value comes from a preceding CanReadSecret."
narrative: The SecureString {param.name} holds a credential for {target.name}; reading it lets the holder
authenticate as {target.name}.