aws-timestream-select-read-data

IAM-effective timestream:Select on a Timestream table allows full data-plane read (SQL-like query), yielding all time-series records including any secret or credential material stored as measures or dimensions.

derived aws emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'table': None}

where

node_type(?table) == Data ?table.provider_type == 'AWS::Timestream::Table' effective_action(?principal, ?table) includes 'timestream:Select'

emit

source type	`Identity`
target type	`Data`
source	`?principal`
target	`?table`
permissions	`timestream:Select`
conditions	`iam_permission`
state logic	(1) If timestream:DescribeEndpoints is NOT present in the effective policy on resource '': CONDITIONAL(iam_permission) — endpoint discovery will fail before Select is attempted. Evaluator must check: effective_action(?principal, "") includes 'timestream:DescribeEndpoints'. (2) If ?table.encryptionSpec.kmsKeyId is a customer-managed key (i.e., the EncryptionType is CUSTOMER_MANAGED_KEY and kmsKeyId is not the AWS-owned default alias): Emitted edge is CONDITIONAL(iam_permission, key_permission) — the caller needs kms:Decrypt on the CMK; cite credential-chains:decrypt- gates-secret-read to upgrade when CanDecrypt on the CMK is confirmed. (3) Otherwise (AWS_OWNED_KMS or no KMS key specified, and DescribeEndpoints on '*' is confirmed): ACTIVE on iam_permission alone.

Narrative

{principal.name} can execute SQL-like SELECT queries against {table.name} (timestream:Select), reading all time-series records stored in the table. If {table.name} contains credentials or secret material ingested as measure values or dimension attributes, this yields further pivots via credential-chains:read-secret-yields-identity.

Raw rule rules/derived/aws/timestream.yaml

id: aws-timestream-select-read-data
emits: CanReadData
description: IAM-effective timestream:Select on a Timestream table allows full data-plane read (SQL-like
  query), yielding all time-series records including any secret or credential material stored as measures
  or dimensions.
match:
- - principal: null
  - HasPermission
  - table: null
where:
- node_type(?table) == Data
- ?table.provider_type == 'AWS::Timestream::Table'
- effective_action(?principal, ?table) includes 'timestream:Select'
emit:
  source_type: Identity
  target_type: Data
  source: ?principal
  target: ?table
  permissions:
  - timestream:Select
  conditions:
  - iam_permission
  state_logic: "(1) If timestream:DescribeEndpoints is NOT present in the effective policy on resource\
    \ '*': CONDITIONAL(iam_permission) \u2014 endpoint discovery will fail before Select is attempted.\
    \ Evaluator must check: effective_action(?principal, \"*\") includes 'timestream:DescribeEndpoints'.\
    \ (2) If ?table.encryptionSpec.kmsKeyId is a customer-managed key (i.e., the EncryptionType is CUSTOMER_MANAGED_KEY\
    \ and kmsKeyId is not the AWS-owned default alias): Emitted edge is CONDITIONAL(iam_permission, key_permission)\
    \ \u2014 the caller needs kms:Decrypt on the CMK; cite credential-chains:decrypt- gates-secret-read\
    \ to upgrade when CanDecrypt on the CMK is confirmed. (3) Otherwise (AWS_OWNED_KMS or no KMS key specified,\
    \ and DescribeEndpoints on '*' is confirmed): ACTIVE on iam_permission alone."
  confidence: contributing_confidence * 0.95
  derived_from:
  - <HasPermission edge for timestream:Select on ?table>
  false_positive_note: "Honor the exact resource ARN scope of the timestream:Select grant \u2014 the ARN\
    \ format is arn:aws:timestream:<region>:<account>:database/<db>/table/<table>; a grant scoped to a\
    \ specific table does not cover other tables in the same database unless the ARN uses a wildcard (database/*/table/*).\
    \ Do not emit ACTIVE when the table has a customer-managed KMS key and the principal's kms:Decrypt\
    \ on that key has not been confirmed; emit CONDITIONAL(key_permission) and rely on credential-chains:decrypt-gates-secret-read\
    \ for the state upgrade. The DescribeEndpoints condition (resource '*') is verified in state_logic\
    \ and may gate the emission to CONDITIONAL(iam_permission) if absent; evaluator must check effective_action(?principal,\
    \ \"*\") includes 'timestream:DescribeEndpoints'."
  narrative: '{principal.name} can execute SQL-like SELECT queries against {table.name} (timestream:Select),
    reading all time-series records stored in the table. If {table.name} contains credentials or secret
    material ingested as measure values or dimension attributes, this yields further pivots via credential-chains:read-secret-yields-identity.'