NoSQLDatabase
DynamoDB/Cosmos/Firestore/Bigtable.
class: Data
Realizing resources
aws aws
| resource | scope | enumerate | required permissions |
|---|---|---|---|
aws:documentdb:db_cluster |
regional | documentdb:DescribeDBClusters |
rds:DescribeDBClusters |
aws:dynamodb:table |
regional | dynamodb:ListTables |
dynamodb:ListTables |
aws:keyspaces:keyspace |
regional | cassandra:Select |
cassandra:Select |
aws:neptune:db_cluster |
regional | neptune:DescribeDBClusters |
rds:DescribeDBClusters |
gcp gcp
| resource | scope | enumerate | required permissions |
|---|---|---|---|
gcp:bigtableadmin:instance |
global | bigtableadmin.projects.instances.list |
bigtable.instances.list |
gcp:firestore:database |
global | firestore.projects.databases.list |
datastore.databases.list |
azure azure
| resource | scope | enumerate | required permissions |
|---|---|---|---|
azure:documentdb:cosmos |
global | arg:microsoft.documentdb/databaseaccounts |
Microsoft.DocumentDB/databaseaccounts/read |
As edge source
As edge target
AuthenticatesToCanAdministerCanAttachIdentityCanControlCanCreateCanDeleteCanDeleteDataCanExfiltrateCanModifyCanModifyConfigurationCanModifyPolicyCanNetworkReachCanReachPortCanReadCanReadDataCanReplaceCanTakeOwnershipCanWriteCanWriteDataContainsContainsResourceReferenceControlsCredentialsForHasPermissionPrivateReachabilityExposure sites
aws-accessanalyzer-finding-details-metadataaws-appflow-flow-data-destinationaws-athena-query-result-rowsaws-backup-recovery-point-restored-contentaws-bedrock-runtime-prompt-response-payloadaws-cloudfront-key-value-store-valueaws-cloudtrail-event-data-store-query-resultsaws-cloudtrail-event-request-response-payload
Rules that touch NoSQLDatabase 64
Principal with rds:ModifyDBCluster on the cluster resource ARN can modify cluster configuration, including resetting the master user password without knowing the current password.
DocumentDB cluster stores its master MongoDB user password in a Secrets Manager secret when ManageMasterUserPassword is enabled.
aws
ContainsSecretrds:CopyDBClusterSnapshot + rds:ModifyDBClusterSnapshotAttribute together enable exfiltration of automated DocumentDB cluster snapshots: copy an automated snapshot to manual, then share the manual copy cross-account or publicly.
aws
CanExfiltraterds:ModifyDBCluster with MasterUserPassword resets the cluster's master password to an attacker-known value, granting superuser MongoDB access without knowing the current password - a single control-plane escalation primitive.
aws
CanReadDataA DocumentDB cluster with PubliclyAccessible=true and a VPC security group permitting inbound TCP 27017 from 0.0.0.0/0 or ::/0 is network-reachable from the public internet. Valid MongoDB credentials (obtained via credential-grab paths) enable connection without VPC foothold.
A principal that can read the DocumentDB master-password secret from Secrets Manager can authenticate to the cluster as the master MongoDB user, gaining full data-plane access (read/write/drop) across all databases on the cluster.
aws
CanReadDataA principal with access to a DAX cluster (dax:GetItem / dax:Query / dax:Scan / dax:BatchGetItem) reads DynamoDB data through the cache, inheriting the DAX cluster's attached IAM role's DynamoDB permissions.
aws
CanReadDatadynamodb:UpdateContinuousBackups (enable PITR) + dynamodb:ExportTableToPointInTime yields full-table exfiltration even if PITR is currently disabled - two-step escalation.
aws
CanExfiltratedynamodb:ExportTableToPointInTime (requires PITR enabled) writes a complete table snapshot to a caller-specified S3 bucket - full table exfiltration in one API call.
aws
CanExfiltratedynamodb:PutResourcePolicy allows rewriting the table/stream resource policy, enabling self-grant of data-plane access or cross-account grant - a direct privilege escalation primitive.
aws
CanModifyPolicydynamodb:GetItem / Query / Scan grants item-level read access to the table, including any secrets or sensitive data stored as item attributes.
aws
CanReadDatadynamodb:RestoreTableFromBackup restores a table from an on-demand backup; reading it requires separate GetItem/Scan/Query permission on the restored table ARN (CONDITIONAL path).
aws
CanReadDatadynamodb:RestoreTableToPointInTime creates a new table from PITR; reading it requires separate GetItem/Scan/Query permission on the restored table ARN (CONDITIONAL path).
aws
CanReadDatadynamodb:GetShardIterator + dynamodb:GetRecords on a DynamoDB Stream yields real-time access to all item-level changes, including full item images depending on StreamViewType.
aws
CanReadDatadynamodb:PutItem / UpdateItem / DeleteItem / BatchWriteItem / TransactWriteItems grant item-level write access, enabling data poisoning (stream injection), TTL manipulation, and denial-of-service.
aws
CanWriteDatacassandra:Alter on a source table to enable PITR, then cassandra:Restore + cassandra:Create + cassandra:Select on the target keyspace permits PITR exfiltration even when PITR is initially disabled. This is a two-step escalation path (POTENTIAL state).
aws
CanReadDataIAM-effective cassandra:Modify on a Keyspaces table allows CQL INSERT, UPDATE, and DELETE, enabling data tampering and injection attacks.
aws
CanWriteDatacassandra:Restore on a source table + cassandra:Create + cassandra:Select on the target keyspace permits PITR-based table copy exfiltration: attacker restores source table data to a new table they control and can read via cassandra:Select.
aws
CanReadDataIAM-effective cassandra:Select on a Keyspaces table allows full data-plane read (CQL SELECT), yielding all row data including any secret material.
aws
CanReadDataPrincipal with rds:ModifyDBCluster on the cluster resource ARN can administer the cluster: modify IAM auth settings, VPC security groups, parameter groups, and deletion protection.
aws
CanAdministerPrincipal with rds:ModifyDBCluster on the cluster resource ARN can modify cluster configuration, including disabling IAM database authentication.
Principal with neptune-db:connect and neptune-db:DeleteDataViaQuery on the cluster resource ARN can execute delete queries and erase graph data.
aws
CanDeleteDataPrincipal with neptune-db:connect and neptune-db:ReadDataViaQuery on the cluster resource ARN can read all graph data via IAM-authenticated queries.
aws
CanReadDataPrincipal with neptune-db:connect and neptune-db:WriteDataViaQuery on the cluster resource ARN can execute write/mutation queries and modify graph data.
aws
CanWriteDataPrincipal with CanModifyConfiguration on a Neptune cluster can disable IAM authentication to escalate to CanReadData if the cluster is publicly accessible or network-reachable.
aws
CanReadDataNeptune DB instance with a public endpoint, permissive security group (port 8182/8183/8184 from 0.0.0.0/0), and IAM database authentication disabled is accessible from the internet without any credential.
Principal with neptune-db:connect and neptune-db:GetStreamRecords on the cluster resource ARN can read all graph mutations via Neptune Streams.
aws
CanReadDataqldb:ExportJournalToS3 + iam:PassRole (for a role with s3:PutObject) allows the caller to exfiltrate the entire QLDB journal - all committed document revisions across all tables - to an S3 bucket, including cross-account buckets.
aws
CanExfiltrateqldb:PartiQLSelect (plus qldb:SendCommand as session gate) on a STANDARD-mode ledger's table allows the caller to read all documents from that table, yielding data-plane read scoped to the individual table.
aws
CanReadDataqldb:PartiQLHistoryFunction (plus qldb:SendCommand as session gate) on a STANDARD-mode ledger's table allows the caller to read all document revisions (full version history) from that table, yielding data-plane read scoped to the individual table with higher impact than current-state-only reads.
aws
CanReadDataqldb:SendCommand on an ALLOW_ALL-mode ledger allows the caller to run arbitrary PartiQL SELECT statements against all tables, yielding full data-plane read of all committed document revisions.
aws
CanReadDataqldb:StreamJournalToKinesis + iam:PassRole (for a role with kinesis:PutRecord) allows the caller to continuously stream the entire QLDB journal - all committed document revisions across all tables - to a Kinesis Data Stream, including cross-account streams.
aws
CanExfiltratedatabaseAccounts/write allows modifying account properties (disableLocalAuth, firewall, CMK) - enabling configuration attacks such as re-enabling key auth or firewall bypass.
azure
CanModifyConfigurationCosmos DB account with firewall restricted to 0.0.0.0 (all Azure IPs) - accessible from any Azure-hosted workload but not the open internet.
azure
ExposedToTenantData read on CMK-encrypted Cosmos DB account - BLOCKED state when the Key Vault key is revoked or disabled.
azure
CanReadDataCosmos DB Built-in Data Contributor (or custom role with items/*) grants data-plane write - enabling item creation, replacement, upsert, and deletion.
azure
CanWriteDataCosmos DB Built-in Data Reader (or custom role with items/read + executeQuery) grants effective data-plane read of items and query execution.
azure
CanReadDatalistConnectionStrings/action returns connection strings embedding the Cosmos DB master keys - equivalent credential exposure to listKeys.
azure
ExposesCredentiallistConnectionStrings/action returns connection strings embedding full master keys - equivalent complete data exfiltration as listKeys.
azure
CanExfiltratelistKeys/action returns Cosmos DB master keys, bypassing all data-plane RBAC and network controls.
azure
ExposesCredentiallistKeys/action returns full master keys enabling complete data exfiltration (read/write/delete all items across all databases and containers).
azure
CanExfiltrateCosmos DB account with no IP firewall and public network access enabled exposes its data-plane endpoint to the internet - any caller with a valid token can reach it.
azure
ExposedToInternetRead-only keys (from readonlykeys/action) enable read-only data exfiltration across all databases and containers.
azure
CanExfiltratereadonlykeys/action returns Cosmos DB read-only master keys - bypasses data-plane RBAC for read operations across all databases and containers.
azure
ExposesCredentialsqlRoleAssignments/write allows modifying Cosmos DB's native data-plane RBAC policy via role assignment creation/updates - enabling privilege escalation by assigning high-privilege roles to oneself.
azure
CanModifyPolicyStorage Table Data Reader grants table entity read - table data may contain application credentials or sensitive configuration.
azure
CanReadDatabigtable.authorizedViews.readRows grants read access to a scoped subset of a table (row key prefix / column qualifier filtering). The caller can only read the rows/columns defined by the authorized view; access to the parent table is NOT granted. CanReadData is scoped to the AuthorizedView node.
gcp
CanReadDatabigtable.tables.readRows constitutes effective data-plane read access: the caller can stream any row from any column family in the table via the ReadRows API. For CMEK-encrypted clusters the capability is CONDITIONAL(key_permission) on the Bigtable service agent's Cloud KMS grant, not on the caller's own KMS permissions.
gcp
CanReadDataShowing 60. Filter all rules for NoSQLDatabase.