Neptune

OVERVIEW ===

MASTER USER ACCOUNT SECURITY ===

NEPTUNE GRAPH DATABASE ADMINISTRATIVE SECURITY ===

• Master User: Create with full administrative privileges for graph operations
• TLS Encryption: Enable HTTPS/TLS for all client connections (required)
• Connection Security: Configure connection limits and timeouts
• Query Languages: Secure access for both Gremlin and SPARQL endpoints
• Audit Logging: Enable audit logs for administrative operations
• Network Security: Deploy in private subnets with restrictive security groups

AWS IAM INTEGRATION ===

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "neptune:CreateDBCluster",
        "neptune:ModifyDBCluster",
        "neptune:DescribeDBClusters"
      ],
      "Resource": "*",
      "Condition": {
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        }
      }
    }
  ]
}

Security-Related Settings Restricted to Master User and IAM Policies

1. Cluster Management Operations (IAM-Controlled)

• neptune:CreateDBCluster - Create new Neptune clusters
• neptune:DeleteDBCluster - Delete Neptune clusters
• neptune:ModifyDBCluster - Modify cluster configuration
• neptune:CreateDBInstance - Add instances to cluster
• neptune:DeleteDBInstance - Remove instances from cluster
• neptune:ModifyDBInstance - Modify instance configuration
• neptune:CreateDBClusterSnapshot - Create manual snapshots
• neptune:RestoreDBClusterFromSnapshot - Restore from snapshots

• Cluster creation/deletion affects data availability and costs
• Cluster modifications can impact security settings (encryption, IAM auth)
• Instance management affects cluster capacity and performance
• Snapshot operations enable backup and potential data exfiltration
• These operations require AWS IAM permissions, not database credentials

2. IAM Database Authentication Management

• Enable/disable IAM database authentication on cluster
• Grant neptune-db:connect permissions via IAM policies
• Configure IAM roles for database access
• Manage temporary credentials for graph operations

• IAM authentication provides fine-grained access control
• Temporary credentials reduce credential exposure risk
• IAM policies control who can access graph data
• Misconfigured IAM policies could grant excessive access
• IAM authentication bypasses traditional username/password

3. Graph Data Access Operations (IAM Data Plane)

• neptune-db:ReadDataViaQuery - Read graph data using Gremlin/SPARQL
• neptune-db:WriteDataViaQuery - Write graph data
• neptune-db:DeleteDataViaQuery - Delete graph data
• neptune-db:GetEngineStatus - View engine status
• neptune-db:GetQueryStatus - View query execution status
• neptune-db:CancelQuery - Cancel running queries
• neptune-db:GetStatisticsStatus - Access statistics

• Read access allows viewing all graph data
• Write access enables data modification and potential corruption
• Delete access can result in permanent data loss
• Query cancellation could disrupt legitimate operations
• Statistics reveal graph structure and usage patterns

4. Parameter Group Management

• Create custom DB cluster parameter groups
• Modify parameter group settings
• Apply parameter groups to clusters
• Configure Neptune-specific parameters (query timeout, audit logging)

• Parameter changes affect cluster behavior and security
• Query timeout settings impact denial-of-service protection
• Audit logging configuration affects compliance
• Parameter modifications require cluster reboot
• Incorrect parameters could impact availability

5. Network and Encryption Configuration

• Configure VPC security groups
• Modify subnet groups
• Enable/disable encryption at rest (at cluster creation only)
• Configure KMS key for encryption
• Enable/disable HTTPS/TLS enforcement

• Security group changes affect network access control
• Encryption settings cannot be changed after cluster creation
• KMS key access controls data encryption
• TLS enforcement is mandatory for Neptune
• Network misconfiguration could expose cluster publicly

6. Backup and Recovery Operations

• Configure automated backup retention period
• Create manual cluster snapshots
• Delete cluster snapshots
• Copy snapshots to other regions (Use AWS Backups)
• Restore cluster from snapshot
• Perform point-in-time recovery

• Backup retention affects recovery capabilities
• Snapshot access enables data exfiltration
• Cross-region copies may violate data residency requirements
• Restore operations can overwrite existing data
• Snapshot sharing requires careful access control

7. Monitoring and Audit Logging

• Enable/disable audit logging
• Configure CloudWatch Logs export
• Set up CloudWatch alarms
• Enable Enhanced Monitoring
• Configure Performance Insights

• Disabling audit logs could hide malicious activity
• Log data contains sensitive query information
• CloudWatch access requires separate IAM permissions
• Performance Insights reveals query patterns
• Monitoring configuration affects compliance posture

8. Maintenance and Upgrade Operations

• Apply engine version upgrades
• Configure maintenance windows
• Apply security patches
• Modify cluster availability settings
• Enable/disable deletion protection

• Engine upgrades may introduce breaking changes
• Maintenance windows affect availability
• Security patches address known vulnerabilities
• Deletion protection prevents accidental data loss
• Upgrade operations require careful planning

Best Practices for Neptune Administrative Security

Neptune-Specific Security Considerations

• Both query languages have full access to graph data
• IAM policies control access to both endpoints
• Query complexity can impact cluster performance
• Implement query timeouts to prevent resource exhaustion

• Provides temporary, token-based access
• Tokens expire after 15 minutes
• Eliminates need for password management
• Integrates with AWS IAM for centralized access control

• Cluster-level settings affect all instances
• Instance-level settings affect individual nodes
• Some operations require cluster reboot
• Plan maintenance windows for configuration changes

IAM Least Privilege Policies

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "neptune:Describe*",
        "neptune:List*",
        "neptune:Get*"
      ],
      "Resource": "*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "neptune:Describe*",
        "neptune:List*",
        "neptune:Get*",
        "neptune:Update*",
        "neptune:Put*"
      ],
      "Resource": "*",
      "Condition": {
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        }
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "neptune:*",
      "Resource": "*",
      "Condition": {
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        },
        "NumericLessThan": {
          "aws:MultiFactorAuthAge": "3600"
        }
      }
    }
  ]
}

Master User Authentication and Graph Database Security

Implementation Examples

1. Configure Encryption and Secure Cluster Creation
   Set up Amazon Neptune cluster with comprehensive encryption, authentication, and security configurations

# Create customer-managed KMS key for Neptune encryption
aws kms create-key \
  --description 'Amazon Neptune Cluster Encryption Key' \
  --key-usage ENCRYPT_DECRYPT \
  --key-spec SYMMETRIC_DEFAULT

# Create alias for the KMS key
aws kms create-alias \
  --alias-name alias/neptune-encryption \
  --target-key-id arn:aws:kms:region:account:key/key-id

# Store master user credentials in Secrets Manager
aws secretsmanager create-secret \
  --name neptune/master-user \
  --description 'Neptune master user credentials' \
  --secret-string '{"username":"neptuneadmin","password":"'$(openssl rand -base64 32)'"}'

# Create DB subnet group for Neptune cluster
aws neptune create-db-subnet-group \
  --db-subnet-group-name neptune-secure-subnet-group \
  --db-subnet-group-description 'Secure subnet group for Neptune cluster' \
  --subnet-ids subnet-12345678 subnet-87654321 subnet-11223344 \
  --tags Key=Environment,Value=Production Key=Compliance,Value=FedRAMP

1. Create Secure Neptune Cluster with Master User
   Create Neptune cluster with encryption and secure master user configuration

# Retrieve master user credentials from Secrets Manager
MASTER_CREDS=$(aws secretsmanager get-secret-value \
  --secret-id neptune/master-user \
  --query 'SecretString' --output text)

MASTER_USERNAME=$(echo $MASTER_CREDS | jq -r '.username')
MASTER_PASSWORD=$(echo $MASTER_CREDS | jq -r '.password')

# Create secure Neptune cluster with encryption
aws neptune create-db-cluster \
  --db-cluster-identifier secure-neptune-cluster \
  --engine neptune \
  --engine-version 1.3.1.0 \
  --master-username "$MASTER_USERNAME" \
  --master-user-password "$MASTER_PASSWORD" \
  --storage-encrypted \
  --kms-key-id alias/neptune-encryption \
  --vpc-security-group-ids sg-12345678 \
  --db-subnet-group-name neptune-secure-subnet-group \
  --backup-retention-period 7 \
  --preferred-backup-window '05:00-06:00' \
  --preferred-maintenance-window 'sun:06:00-sun:07:00' \
  --enable-iam-database-authentication \
  --deletion-protection \
  --tags Key=DataClassification,Value=Sensitive Key=BackupRequired,Value=true

# Create Neptune DB instances in the cluster
aws neptune create-db-instance \
  --db-instance-identifier secure-neptune-instance-1 \
  --db-instance-class db.r6g.large \
  --engine neptune \
  --db-cluster-identifier secure-neptune-cluster \
  --monitoring-interval 60 \
  --monitoring-role-arn arn:aws:iam::account:role/rds-monitoring-role \
  --performance-insights-enabled \
  --performance-insights-kms-key-id alias/neptune-encryption \
  --tags Key=Role,Value=Primary

1. Configure IAM Database Authentication and Monitoring
   Set up IAM database authentication and comprehensive monitoring for Neptune

# Create IAM policy for Neptune database access
cat > neptune-db-access-policy.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "neptune-db:connect",
        "neptune-db:ReadDataViaQuery",
        "neptune-db:WriteDataViaQuery"
      ],
      "Resource": "arn:aws:neptune-db:*:*:cluster-resource/secure-neptune-cluster/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "us-east-1"
        }
      }
    }
  ]
}
EOF

aws iam create-policy \
  --policy-name NeptuneDBAccessPolicy \
  --policy-document file://neptune-db-access-policy.json

# Enable CloudTrail logging for Neptune API calls
aws cloudtrail create-trail \
  --name neptune-audit-trail \
  --s3-bucket-name neptune-audit-logs-bucket \
  --include-global-service-events \
  --is-multi-region-trail \
  --enable-log-file-validation

# Enable Neptune audit logging
aws neptune modify-db-clust

Privileged Access Control

Implementation Examples

1. Implement Least Privilege Access
   Configure Amazon Neptune with minimal required permissions for administrative accounts

# Create least privilege IAM policy for Neptune administration
cat > neptune-admin-policy.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "neptune:CreateDBCluster",
        "neptune:ModifyDBCluster",
        "neptune:DescribeDBClusters",
        "neptune:CreateDBInstance",
        "neptune:ModifyDBInstance",
        "neptune:DescribeDBInstances",
        "neptune:CreateDBClusterSnapshot",
        "neptune:DescribeDBClusterSnapshots"
      ],
      "Resource": "*",
      "Condition": {
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        },
        "NumericLessThan": {
          "aws:MultiFactorAuthAge": "3600"
        }
      }
    }
  ]
}
EOF

aws iam create-policy \
  --policy-name NeptuneAdminPolicy \
  --policy-document file://neptune-admin-policy.json

# Attach policy to administrative role
aws iam attach-role-policy \
  --role-name NeptuneAdminRole \
  --policy-arn arn:aws:iam::account:policy/NeptuneAdminPolicy

1. Enable Multi-Factor Authentication
   Require MFA for all privileged operations and administrative access

# MFA enforcement is configured through IAM policy conditions
# Verify MFA enforcement for privileged operations
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::account:role/NeptuneAdminRole \
  --action-names neptune:CreateDBCluster \
  --context-entries ContextKeyName=aws:MultiFactorAuthPresent,ContextKeyValues=false,ContextKeyType=boolean

1. Configure Privileged Activity Monitoring
   Enable comprehensive logging and monitoring of all privileged account activities

# Enable CloudTrail for API logging
aws cloudtrail create-trail \
  --name NeptunePrivilegedAccess \
  --s3-bucket-name neptune-audit-logs \
  --include-global-service-events \
  --is-multi-region-trail \
  --enable-log-file-validation

# Configure CloudWatch alarms for privileged operations
aws logs create-log-group \
  --log-group-name /aws/neptune/privileged-access \
  --retention-in-days 365

# Create metric filter for privileged operations
aws logs put-metric-filter \
  --log-group-name CloudTrail/NeptunePrivilegedAccess \
  --filter-name NeptunePrivilegedOperations \
  --filter-pattern '{ $.eventSource = "neptune.amazonaws.com" && $.userIdentity.type = "AssumedRole" }' \
  --metric-transformations \
    metricName=NeptunePrivilegedOperations,metricNamespace=Security/Neptune,metricValue=1

Implementation

• Enable encryption at rest using customer-managed KMS keys
• Use AWS Secrets Manager for master user password management
• Enforce HTTPS/TLS connections for all database access (mandatory)
• Enable IAM database authentication for fine-grained access control
• Deploy in private subnets with restrictive security groups
• Implement automated backup encryption
• Configure comprehensive audit logging for graph operations
• Use least privilege IAM policies for both cluster and database access

AWS Config Implementation

aws neptune describe-* --query 'relevant-fields'
Compare output against baseline configuration files

Automation

Export Format

aws neptune describe-* --output json > amazon_neptune_config.json

• Backup current configuration
• Compare configurations across environments
• Audit and compliance reporting
• Infrastructure as Code generation

Create Neptune Cluster

aws neptune create-db-cluster \
  --db-cluster-identifier <cluster-name> \
  --storage-encrypted \
  --kms-key-id <kms-key-id>

Create Neptune Instance

aws neptune create-db-instance \
  --db-instance-identifier <instance-name> \
  --db-cluster-identifier <cluster-name> \
  --db-instance-class <instance-class>

Enable IAM Database Authentication

aws neptune modify-db-cluster \
  --db-cluster-identifier <cluster-name> \
  --enable-iam-database-authentication

• Create separate roles for different access levels (read-only, operator, administrator)
• Always require MFA for privileged operations
• Use time-based conditions to limit session duration
• Apply resource-specific restrictions where possible
• Regularly review and audit policy assignments
• Use AWS Access Analyzer to validate least privilege

• Start with read-only access and add permissions as needed
• Use AWS managed policies as a baseline when available
• Implement just-in-time access for administrative operations
• Monitor policy usage with CloudTrail and Access Analyzer
• Document business justification for each permission