Namespace
K8s namespace or logical partition.
class: AdministrativeBoundary derivation-only - no collection recipe
Realizing resources
This type has no collection recipe - it appears only as the endpoint of derived edges.
As edge source
As edge target
Exposure sites
None.
Rules that touch Namespace 5
quicksight:RegisterUser + quicksight:UpdateUser (role=ADMIN) lets an attacker promote themselves or others to QuickSight admin, gaining read access to all datasets, dashboards, and data source configurations.
A principal with secretsmanager:GetSecretValue on the Redshift ManagedAdminPassword secret can retrieve the plaintext admin DB password and connect as superuser, reading all warehouse data.
aws
CanReadDataredshift:AuthorizeDataShare grants a consumer AWS account real-time read access to producer cluster objects, establishing cross-account live data trust.
Pass a privileged IAM role to a Redshift cluster (iam:PassRole + ModifyClusterIamRoles), then submit a COPY/UNLOAD/UDF query that uses that role's AWS permissions. Covers both already-attached and attach-new-then-execute paths.
aws
CanExecuteAsredshift-serverless:PutResourcePolicy allows a principal to grant another AWS account live access to a Redshift Serverless namespace via resource policy.