AWS - RDS Post Exploitation
RDS
For more information check:
AWS - Relational Database (RDS) Enumrds:CreateDBSnapshot
, rds:RestoreDBInstanceFromDBSnapshot
, rds:ModifyDBInstance
rds:CreateDBSnapshot
, rds:RestoreDBInstanceFromDBSnapshot
, rds:ModifyDBInstance
If the attacker has enough permissions, he could make a DB publicly accessible by creating a snapshot of the DB, and then a publicly accessible DB from the snapshot.
rds:ModifyDBSnapshotAttribute
, rds:CreateDBSnapshot
rds:ModifyDBSnapshotAttribute
, rds:CreateDBSnapshot
An attacker with these permissions could create an snapshot of a DB and make it publicly available. Then, he could just create in his own account a DB from that snapshot.
If the attacker doesn't have the rds:CreateDBSnapshot
, he still could make other created snapshots public.
rds:DownloadDBLogFilePortion
rds:DownloadDBLogFilePortion
An attacker with the rds:DownloadDBLogFilePortion
permission can download portions of an RDS instance's log files. If sensitive data or access credentials are accidentally logged, the attacker could potentially use this information to escalate their privileges or perform unauthorized actions.
Potential Impact: Access to sensitive information or unauthorized actions using leaked credentials.
rds:DeleteDBInstance
rds:DeleteDBInstance
An attacker with these permissions can DoS existing RDS instances.
Potential impact: Deletion of existing RDS instances, and potential loss of data.
rds:StartExportTask
rds:StartExportTask
TODO: Test
An attacker with this permission can export an RDS instance snapshot to an S3 bucket. If the attacker has control over the destination S3 bucket, they can potentially access sensitive data within the exported snapshot.
Potential impact: Access to sensitive data in the exported snapshot.
Last updated