Cache

A principal with access to a DAX cluster (dax:GetItem / dax:Query / dax:Scan / dax:BatchGetItem) reads DynamoDB data through the cache, inheriting the DAX cluster's attached IAM role's DynamoDB permissions.

elasticache:CreateSnapshot combined with elasticache:CopySnapshot allows creating a fresh Redis RDB snapshot from a running cache and immediately exporting it to an attacker-controlled S3 bucket. The RDB file is a complete serialized dump of all in-memory data at snapshot time, bypassing the need for scheduled snapshots. No live cluster access needed.

elasticache:ModifyReplicationGroup with AuthToken + AuthTokenUpdateStrategy=SET (or AuthTokenEnabled=false) sets or removes the Redis AUTH token to an attacker-controlled value. elasticache:ModifyUser resets ACL user passwords. elasticache:ModifyServerlessCache modifies UserGroup bindings. The principal gains the capability to mutate cache auth configuration; paired with network reachability, this yields data-plane access.

A Redis/Valkey cluster with AuthTokenEnabled=false (or absent) or a Memcached cluster is accessible to any VPC-reachable compute resource with an inbound security group rule on the cache port (6379 Redis, 11211 Memcached) - no credential is required. Both read and write operations are permitted without authentication, enabling cache poisoning and lateral movement attacks.

Cluster's ACL contains users (credentials); the cluster exposes those credentials to authenticated network access.

memorydb:CreateUser + memorydb:UpdateAcl creates a privileged ACL user and adds them to a cluster's ACL; with VPC reach, principal can then read all cluster data.

memorydb:CreateUser + memorydb:UpdateAcl creates a privileged ACL user; with VPC reach, principal can then write all cluster data.

memorydb:UpdateCluster can swap cluster's ACL to open-access; principal with VPC reach gains full data-plane access to the cluster.

memorydb:UpdateUser overwrites an ACL user password (CanModify on Credential); attacker with VPC reach can then authenticate and read cluster data.

memorydb:UpdateUser overwrites an ACL user password (CanModify on Credential); attacker with VPC reach can then authenticate and write cluster data.

Compute with confirmed VPC network reach to the cluster plus access to an ACL credential can read Redis data.

Compute with confirmed VPC network reach to the cluster plus access to an ACL credential can write Redis data (default ACL permissions allow writes).

Write access to a PaaS resource's privateEndpointConnections lets an attacker approve a PE connection from an attacker-controlled VNet, granting that VNet private network access to the resource - bypassing its public firewall.

ARM write (redis/write) permission grants full control-plane administration: firewall rules, authentication settings, port configuration, managed identity, and deletion.

Cache with authnotrequired=true and publicNetworkAccess=Enabled allows anonymous internet access to the Redis data-plane with full commands.

Retrieving the cache access key via listKeys/action yields full data-plane read of all cached data, subject to network reachability of the Redis endpoint.

Retrieving the cache access key via listKeys/action yields full data-plane write of all cached data (SET, DEL, FLUSHDB, CONFIG SET), subject to network reachability of the Redis endpoint.

The Redis access keys are exposed via the cache resource whenever a principal with listKeys/action can retrieve them. This is a structural credential-exposure edge: the cache itself exposes the keys as a resource-level property, coupled with a principal's CanReadCredential permission.

A principal with listKeys/action permission can retrieve the Redis access key via ARM, gaining read access to the credential.

Cache for Redis with publicNetworkAccess=Enabled and no IP firewall rules exposes the Redis data-plane port 6380 (SSL) to the public internet.

A firewall rule allowing 0.0.0.0–255.255.255.255 explicitly exposes the Redis data-plane endpoint to the entire public internet.

regenerateKey/action allows rotating the Redis access keys, enabling session revocation and credential rotation for persistence. Treated as control capability.

redis/write permission allows attaching/replacing the managed identity used for CMK (data-at-rest encryption).

redis/write permission allows modifying cache configuration including authentication settings, port exposure, TLS version, and managed identity for CMK.

Possession of the Redis AUTH string (retrieved via redis.instances.getAuthString) combined with in-VPC network reach to the Redis port grants full data-plane read access to all keys on the Memorystore instance.

Possession of the Redis AUTH string combined with in-VPC network reach grants full data-plane write access (SET, DEL, FLUSHALL, etc.), enabling cache poisoning and supply-chain injection attacks against dependent applications.

redis.instances.getAuthString retrieves the Redis AUTH string (UUID), which is the shared credential granting full Redis data-plane access to any in-VPC client that possesses it. This is the Memorystore "master key" credential grab.

When AUTH is disabled (the GCP default), any in-VPC client (Identity, Compute, Container, KubernetesWorkload) with network reachability to port 6379/6380 gains full unauthenticated Redis data-plane read access. No credential retrieval is needed.

When AUTH is disabled (the GCP default), any in-VPC client (Identity, Compute, Container, KubernetesWorkload) with network reachability to port 6379/6380 gains full unauthenticated Redis data-plane write access (SET, DEL, FLUSHALL, CONFIG), enabling cache poisoning and supply-chain injection attacks.