rage.fail

aws-account-attached-scp

explicit aws emits HasPolicy

match (record)

{ "field": "AttachedSCPs", "resource_type": "AWS::Organizations::Account" }

where

an SCP is attached to the account or an OU on its path (organizations:ListPoliciesForTarget, filter=SERVICE_CONTROL_POLICY)

emit

source type	`*`
target type	`Policy`
source	`<Account node>`
target	`<ServiceControlPolicy guardrail node (created by organizations adapter)>`

Narrative

{account.name} is in scope of SCP {policy.name}.

Raw rule rules/explicit/aws-account.yaml

id: aws-account-attached-scp
emits: HasPolicy
applies_to:
- aws
match_record:
  resource_type: AWS::Organizations::Account
  field: AttachedSCPs
where:
- an SCP is attached to the account or an OU on its path (organizations:ListPoliciesForTarget, filter=SERVICE_CONTROL_POLICY)
emit:
  source_type: '*'
  target_type: Policy
  source: <Account node>
  target: <ServiceControlPolicy guardrail node (created by organizations adapter)>
  api_source: organizations:ListPoliciesForTarget | organizations:ListTargetsForPolicy
  evidence_field: AttachedSCPs
  narrative: '{account.name} is in scope of SCP {policy.name}.'