Project: KICS (Provisioning / Security & Compliance)
File: 39423ce4-9011-46cd-b6b1-009edcd9385d.md

title: DocDB Cluster Master Password In Plaintext hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 39423ce4-9011-46cd-b6b1-009edcd9385d Query name: DocDB Cluster Master Password In Plaintext Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Secret Management URL: DocDB DB Cluster master user password must not be in a plain text string or referenced in a parameter as a default value.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="12" Resources: NewAmpApp: Type: AWS::DocDB::DBCluster Properties: BackupRetentionPeriod: 8 DBClusterIdentifier: "sample-cluster" DBClusterParameterGroupName: "default.docdb3.6" DBSubnetGroupName: "default" DeletionProtection: true KmsKeyId: "your-kms-key-id" MasterUsername: "your-master-username" MasterUserPassword: 'asDjskjs73!!' Port: 27017 PreferredBackupWindow: "07:34-08:04" PreferredMaintenanceWindow: "sat:04:51-sat:05:21" SnapshotIdentifier: "sample-cluster-snapshot-id" StorageEncrypted: true ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="5" Parameters: ParentMasterPassword: Description: 'Password' Type: String Default: 'asDjskjs73!' Resources: NewAmpApp1: Type: AWS::DocDB::DBCluster Properties: BackupRetentionPeriod: 8 DBClusterIdentifier: "sample-cluster" DBClusterParameterGroupName: "default.docdb3.6" DBSubnetGroupName: "default" DeletionProtection: true KmsKeyId: "your-kms-key-id" MasterUsername: "your-master-username" MasterUserPassword: !Ref ParentMasterPassword Port: 27017 PreferredBackupWindow: "07:34-08:04" PreferredMaintenanceWindow: "sat:04:51-sat:05:21" SnapshotIdentifier: "sample-cluster-snapshot-id" StorageEncrypted: true ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="12" Resources: NewAmpApp03: Type: AWS::DocDB::DBCluster Properties: BackupRetentionPeriod: 8 DBClusterIdentifier: "sample-cluster" DBClusterParameterGroupName: "default.docdb3.6" DBSubnetGroupName: "default" DeletionProtection: true KmsKeyId: "your-kms-key-id" MasterUsername: "your-master-username" MasterUserPassword: 'asDjskjs73!!' Port: 27017 PreferredBackupWindow: "07:34-08:04" PreferredMaintenanceWindow: "sat:04:51-sat:05:21" SnapshotIdentifier: "sample-cluster-snapshot-id" StorageEncrypted: true ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="17" { "Resources": { "NewAmpApp": { "Type": "AWS::DocDB::DBCluster", "Properties": { "PreferredMaintenanceWindow": "sat:04:51-sat:05:21", "SnapshotIdentifier": "sample-cluster-snapshot-id", "DBClusterParameterGroupName": "default.docdb3.6", "DBSubnetGroupName": "default", "KmsKeyId": "your-kms-key-id", "MasterUsername": "your-master-username", "Port": 27017, "StorageEncrypted": true, "BackupRetentionPeriod": 8, "DBClusterIdentifier": "sample-cluster", "DeletionProtection": true, "MasterUserPassword": "asDjskjs73!!", "PreferredBackupWindow": "07:34-08:04" } } } } ``` </details> <details><summary>Positive test num. 5 - json file</summary> ```json hl_lines="6" { "Parameters": { "ParentMasterPassword": { "Description": "Password", "Type": "String", "Default": "asDjskjs73!" } }, "Resources": { "NewAmpApp1": { "Type": "AWS::DocDB::DBCluster", "Properties": { "KmsKeyId": "your-kms-key-id", "MasterUsername": "your-master-username", "PreferredBackupWindow": "07:34-08:04", "BackupRetentionPeriod": 8, "DBClusterIdentifier": "sample-cluster", "DeletionProtection": true, "MasterUserPassword": "ParentMasterPassword", "Port": 27017, "PreferredMaintenanceWindow": "sat:04:51-sat:05:21", "SnapshotIdentifier": "sample-cluster-snapshot-id", "StorageEncrypted": true, "DBClusterParameterGroupName": "default.docdb3.6", "DBSubnetGroupName": "default" } } } } ``` </details> <details><summary>Positive test num. 6 - json file</summary> ```json hl_lines="18" { "Resources": { "NewAmpApp03": { "Type": "AWS::DocDB::DBCluster", "Properties": { "Port": 27017, "PreferredBackupWindow": "07:34-08:04", "PreferredMaintenanceWindow": "sat:04:51-sat:05:21", "DBClusterIdentifier": "sample-cluster", "DBClusterParameterGroupName": "default.docdb3.6", "DBSubnetGroupName": "default", "DeletionProtection": true, "KmsKeyId": "your-kms-key-id", "SnapshotIdentifier": "sample-cluster-snapshot-id", "StorageEncrypted": true, "BackupRetentionPeriod": 8, "MasterUsername": "your-master-username", "MasterUserPassword": "asDjskjs73!!" } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" Parameters: ParentMasterPassword: Description: 'Password' Type: String Default: '' Resources: NewAmpApp1: Type: AWS::DocDB::DBCluster Properties: BackupRetentionPeriod: 8 DBClusterIdentifier: "sample-cluster" DBClusterParameterGroupName: "default.docdb3.6" DBSubnetGroupName: "default" DeletionProtection: true KmsKeyId: "your-kms-key-id" MasterUsername: "your-master-username" MasterUserPassword: !Ref ParentMasterPassword Port: 27017 PreferredBackupWindow: "07:34-08:04" PreferredMaintenanceWindow: "sat:04:51-sat:05:21" SnapshotIdentifier: "sample-cluster-snapshot-id" StorageEncrypted: true ``` ```json title="Negative test

2 - json file" { "Parameters": { "ParentAccessToken": { "Description": "Access Token", "Type": "String", "Default": "" } }, "Resources": { "NewAmpApp4": { "Type": "AWS::Amplify::App", "Properties": { "AccessToken": "ParentAccessToken", "Description": "String", "Repository": "String", "OauthToken": "String", "BuildSpec": "String", "CustomHeaders": "String", "EnableBranchAutoDeletion": true, "IAMServiceRole": "String", "Name": "NewAmpApp" } } } } ``` ```yaml title="Negative test num. 3 - yaml file" Parameters: ParentMasterPassword: Description: 'Password' Type: String Resources: NewAmpApp1: Type: AWS::DocDB::DBCluster Properties: BackupRetentionPeriod: 8 DBClusterIdentifier: "sample-cluster" DBClusterParameterGroupName: "default.docdb3.6" DBSubnetGroupName: "default" DeletionProtection: true KmsKeyId: "your-kms-key-id" MasterUsername: "your-master-username" MasterUserPassword: !Ref ParentMasterPassword Port: 27017 PreferredBackupWindow: "07:34-08:04" PreferredMaintenanceWindow: "sat:04:51-sat:05:21" SnapshotIdentifier: "sample-cluster-snapshot-id" StorageEncrypted: true ``` <details><summary>Negative test num. 4 - yaml file</summary> ```yaml Resources: NewAmpApp2: Type: AWS::DocDB::DBCluster Properties: MasterUserPassword: !Sub '{{resolve:secretsmanager:${MyAmpAppSecretManagerRotater}::password}}' Port: 27017 PreferredBackupWindow: "07:34-08:04" PreferredMaintenanceWindow: "sat:04:51-sat:05:21" SnapshotIdentifier: "sample-cluster-snapshot-id" StorageEncrypted: true MyAmpAppSecretManagerRotater: Type: AWS::SecretsManager::Secret Properties: Description: 'This is my amp app instance secret' GenerateSecretString: SecretStringTemplate: '{"username":"admin"}' GenerateStringKey: 'password' PasswordLength: 16 ExcludeCharacters: '"@/\' ``` </details> <details><summary>Negative test num. 5 - yaml file</summary> ```yaml Parameters: ParentAccessToken: Description: 'Access Token' Type: String Resources: NewAmpApp1: Type: AWS::Amplify::App Properties: AccessToken: !Ref ParentAccessToken BuildSpec: String CustomHeaders: String Description: String EnableBranchAutoDeletion: true IAMServiceRole: String Name: NewAmpApp OauthToken: String Repository: String ``` </details> <details><summary>Negative test num. 6 - yaml file</summary> ```yaml Parameters: ParentAccessToken: Description: 'Access Token' Type: String Default: "" Resources: NewAmpApp4: Type: AWS::Amplify::App Properties: AccessToken: !Ref ParentAccessToken BuildSpec: String CustomHeaders: String Description: String EnableBranchAutoDeletion: true IAMServiceRole: String Name: NewAmpApp OauthToken: String Repository: String ``` </details> <details><summary>Negative test num. 7 - json file</summary> ```json { "Parameters": { "ParentMasterPassword": { "Description": "Password", "Type": "String", "Default": "" } }, "Resources": { "NewAmpApp1": { "Properties": { "BackupRetentionPeriod": 8, "DBSubnetGroupName": "default", "KmsKeyId": "your-kms-key-id", "MasterUsername": "your-master-username", "Port": 27017, "SnapshotIdentifier": "sample-cluster-snapshot-id", "StorageEncrypted": true, "DBClusterIdentifier": "sample-cluster", "DBClusterParameterGroupName": "default.docdb3.6", "DeletionProtection": true, "MasterUserPassword": "ParentMasterPassword", "PreferredBackupWindow": "07:34-08:04", "PreferredMaintenanceWindow": "sat:04:51-sat:05:21" }, "Type": "AWS::DocDB::DBCluster" } } } ``` </details> <details><summary>Negative test num. 8 - json file</summary> ```json { "Parameters": { "ParentMasterPassword": { "Description": "Password", "Type": "String" } }, "Resources": { "NewAmpApp1": { "Type": "AWS::DocDB::DBCluster", "Properties": { "DBClusterIdentifier": "sample-cluster", "DBSubnetGroupName": "default", "DeletionProtection": true, "MasterUserPassword": "ParentMasterPassword", "Port": 27017, "PreferredBackupWindow": "07:34-08:04", "PreferredMaintenanceWindow": "sat:04:51-sat:05:21", "BackupRetentionPeriod": 8, "SnapshotIdentifier": "sample-cluster-snapshot-id", "KmsKeyId": "your-kms-key-id", "MasterUsername": "your-master-username", "StorageEncrypted": true, "DBClusterParameterGroupName": "default.docdb3.6" } } } } ``` </details> <details><summary>Negative test num. 9 - json file</summary> ```json { "Resources": { "NewAmpApp2": { "Type": "AWS::DocDB::DBCluster", "Properties": { "MasterUserPassword": "{{resolve:secretsmanager:${MyAmpAppSecretManagerRotater}::password}}", "Port": 27017, "PreferredBackupWindow": "07:34-08:04", "PreferredMaintenanceWindow": "sat:04:51-sat:05:21", "SnapshotIdentifier": "sample-cluster-snapshot-id", "StorageEncrypted": true } }, "MyAmpAppSecretManagerRotater": { "Type": "AWS::SecretsManager::Secret", "Properties": { "Description": "This is my amp app instance secret", "GenerateSecretString": { "SecretStringTemplate": "{\"username\":\"admin\"}", "GenerateStringKey": "password", "PasswordLength": 16, "ExcludeCharacters": "\"@/\\" } } } } } ``` </details> <details><summary>Negative test num. 10 - json file</summary> ```json { "Parameters": { "ParentAccessToken": { "Type": "String", "Description": "Access Token" } }, "Resources": { "NewAmpApp1": { "Type": "AWS::Amplify::App", "Properties": { "Name": "NewAmpApp", "OauthToken": "String", "Description": "String", "EnableBranchAutoDeletion": true, "CustomHeaders": "String", "IAMServiceRole": "String", "Repository": "String", "AccessToken": "ParentAccessToken", "BuildSpec": "String" } } } } ``` </details>