Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
Principal with rds:ModifyDBCluster on the cluster resource ARN can modify cluster configuration, including resetting the master user password without knowing the current password.
DocumentDB cluster stores its master MongoDB user password in a Secrets Manager secret when ManageMasterUserPassword is enabled.
rds:CopyDBClusterSnapshot + rds:ModifyDBClusterSnapshotAttribute together enable exfiltration of automated DocumentDB cluster snapshots: copy an automated snapshot to manual, then share the manual copy cross-account or publicly.
rds:ModifyDBCluster with MasterUserPassword resets the cluster's master password to an attacker-known value, granting superuser MongoDB access without knowing the current password - a single control-plane escalation primitive.
A DocumentDB cluster with PubliclyAccessible=true and a VPC security group permitting inbound TCP 27017 from 0.0.0.0/0 or ::/0 is network-reachable from the public internet. Valid MongoDB credentials (obtained via credential-grab paths) enable connection without VPC foothold.
A principal that can read the DocumentDB master-password secret from Secrets Manager can authenticate to the cluster as the master MongoDB user, gaining full data-plane access (read/write/drop) across all databases on the cluster.
A principal with access to a DAX cluster (dax:GetItem / dax:Query / dax:Scan / dax:BatchGetItem) reads DynamoDB data through the cache, inheriting the DAX cluster's attached IAM role's DynamoDB permissions.
dynamodb:UpdateContinuousBackups (enable PITR) + dynamodb:ExportTableToPointInTime yields full-table exfiltration even if PITR is currently disabled - two-step escalation.
dynamodb:ExportTableToPointInTime (requires PITR enabled) writes a complete table snapshot to a caller-specified S3 bucket - full table exfiltration in one API call.
dynamodb:PutResourcePolicy allows rewriting the table/stream resource policy, enabling self-grant of data-plane access or cross-account grant - a direct privilege escalation primitive.
dynamodb:GetItem / Query / Scan grants item-level read access to the table, including any secrets or sensitive data stored as item attributes.
dynamodb:RestoreTableFromBackup restores a table from an on-demand backup; reading it requires separate GetItem/Scan/Query permission on the restored table ARN (CONDITIONAL path).
dynamodb:RestoreTableToPointInTime creates a new table from PITR; reading it requires separate GetItem/Scan/Query permission on the restored table ARN (CONDITIONAL path).
dynamodb:GetShardIterator + dynamodb:GetRecords on a DynamoDB Stream yields real-time access to all item-level changes, including full item images depending on StreamViewType.
dynamodb:PutItem / UpdateItem / DeleteItem / BatchWriteItem / TransactWriteItems grant item-level write access, enabling data poisoning (stream injection), TTL manipulation, and denial-of-service.
cassandra:Alter on a source table to enable PITR, then cassandra:Restore + cassandra:Create + cassandra:Select on the target keyspace permits PITR exfiltration even when PITR is initially disabled. This is a two-step escalation path (POTENTIAL state).
IAM-effective cassandra:Modify on a Keyspaces table allows CQL INSERT, UPDATE, and DELETE, enabling data tampering and injection attacks.
cassandra:Restore on a source table + cassandra:Create + cassandra:Select on the target keyspace permits PITR-based table copy exfiltration: attacker restores source table data to a new table they control and can read via cassandra:Select.
IAM-effective cassandra:Select on a Keyspaces table allows full data-plane read (CQL SELECT), yielding all row data including any secret material.
Principal with rds:ModifyDBCluster on the cluster resource ARN can administer the cluster: modify IAM auth settings, VPC security groups, parameter groups, and deletion protection.
Principal with rds:ModifyDBCluster on the cluster resource ARN can modify cluster configuration, including disabling IAM database authentication.
Principal with neptune-db:connect and neptune-db:DeleteDataViaQuery on the cluster resource ARN can execute delete queries and erase graph data.
Principal with neptune-db:connect and neptune-db:ReadDataViaQuery on the cluster resource ARN can read all graph data via IAM-authenticated queries.
Principal with neptune-db:connect and neptune-db:WriteDataViaQuery on the cluster resource ARN can execute write/mutation queries and modify graph data.
Principal with CanModifyConfiguration on a Neptune cluster can disable IAM authentication to escalate to CanReadData if the cluster is publicly accessible or network-reachable.
Neptune DB instance with a public endpoint, permissive security group (port 8182/8183/8184 from 0.0.0.0/0), and IAM database authentication disabled is accessible from the internet without any credential.
Principal with neptune-db:connect and neptune-db:GetStreamRecords on the cluster resource ARN can read all graph mutations via Neptune Streams.
qldb:ExportJournalToS3 + iam:PassRole (for a role with s3:PutObject) allows the caller to exfiltrate the entire QLDB journal - all committed document revisions across all tables - to an S3 bucket, including cross-account buckets.
qldb:PartiQLSelect (plus qldb:SendCommand as session gate) on a STANDARD-mode ledger's table allows the caller to read all documents from that table, yielding data-plane read scoped to the individual table.
qldb:PartiQLHistoryFunction (plus qldb:SendCommand as session gate) on a STANDARD-mode ledger's table allows the caller to read all document revisions (full version history) from that table, yielding data-plane read scoped to the individual table with higher impact than current-state-only reads.
qldb:SendCommand on an ALLOW_ALL-mode ledger allows the caller to run arbitrary PartiQL SELECT statements against all tables, yielding full data-plane read of all committed document revisions.
qldb:StreamJournalToKinesis + iam:PassRole (for a role with kinesis:PutRecord) allows the caller to continuously stream the entire QLDB journal - all committed document revisions across all tables - to a Kinesis Data Stream, including cross-account streams.
databaseAccounts/write allows modifying account properties (disableLocalAuth, firewall, CMK) - enabling configuration attacks such as re-enabling key auth or firewall bypass.
Cosmos DB account with firewall restricted to 0.0.0.0 (all Azure IPs) - accessible from any Azure-hosted workload but not the open internet.
Data read on CMK-encrypted Cosmos DB account - BLOCKED state when the Key Vault key is revoked or disabled.
Cosmos DB Built-in Data Contributor (or custom role with items/*) grants data-plane write - enabling item creation, replacement, upsert, and deletion.
Cosmos DB Built-in Data Reader (or custom role with items/read + executeQuery) grants effective data-plane read of items and query execution.
listConnectionStrings/action returns connection strings embedding the Cosmos DB master keys - equivalent credential exposure to listKeys.
listConnectionStrings/action returns connection strings embedding full master keys - equivalent complete data exfiltration as listKeys.
listKeys/action returns Cosmos DB master keys, bypassing all data-plane RBAC and network controls.
listKeys/action returns full master keys enabling complete data exfiltration (read/write/delete all items across all databases and containers).
Cosmos DB account with no IP firewall and public network access enabled exposes its data-plane endpoint to the internet - any caller with a valid token can reach it.