aws-networkfirewall-rule-variable-values
Rule variable definitions expose private network ranges and may contain misplaced sensitive strings.
Where it sits
| location | DescribeRuleGroup.RuleGroup.RuleVariables.IPSets[].Definition / PortSets[].Definition |
|---|---|
| location kind | config_field |
| data kinds | sensitive_data pii credential |
| emits edge | ContainsSecret |
| service | Network Firewall (aws:networkfirewall) |
Collection recipe
| access mode | read_api |
|---|---|
| operation | DescribeRuleGroup |
| response path | RuleGroup.RuleVariables |
| encoding | json |
| params | {"RuleGroupArn": "\u003crule-group-arn\u003e"} |
Required permissions
network-firewall:DescribeRuleGroup