aws-account-enter-via-oaar

id: aws-account-enter-via-oaar
emits: CanEnterAccount
description: A management-account principal that can assume OrganizationAccountAccessRole enters the member
  account as full admin.
match:
- - principal: null
  - CanAssume
  - oaar: null
- - oaar: null
  - CrossAccountTrust
  - mgmt_account: null
where:
- node_type(?oaar) == Role and ?oaar.name == 'OrganizationAccountAccessRole'
- 'account_of(?principal) == account_of(?mgmt_account)  # caller is IN the management account'
- 'account_of(?oaar) != account_of(?principal)          # OAAR is in the MEMBER account (cross-account)'
emit:
  source_type: Identity
  target_type: Account
  source: ?principal
  target: <member Account that owns ?oaar>
  permissions:
  - sts:AssumeRole
  conditions:
  - trust_relationship
  - scp_or_org_policy
  state_logic: ACTIVE when ?principal holds effective sts:AssumeRole on the OAAR ARN, the trust is intact,
    and no SCP at the member's OU/account denies sts:AssumeRole. CONDITIONAL(trust_relationship) if the
    role's existence or trust integrity is unconfirmed. BLOCKED(scp_or_org_policy) if an SCP denies sts:AssumeRole
    for the OAAR at the member scope -> then hierarchy-chains rule 3 (fed by the explicit aws-account-leave-org-escapes-scp
    move-out edge) may upgrade it once the SCP is removed/escaped.
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - <CanAssume edge_id (identity-escalation aws-assume-role)>
  - <CrossAccountTrust edge_id (explicit aws-account-oaar-crossaccount-trust)>
  note: "This is deliberately the ACCOUNT-level specialization of can-control's enter-account-via-assume:\
    \ that generic rule already turns any cross-account CanAssume into CanEnterAccount. We keep this rule\
    \ so the OAAR-as-admin path is first-class (target account admin, not a scoped role) and so the CanEnterAccount->Controls->admin-inherits-down-contains\
    \ chain (hierarchy-chains rule 1) fires over the WHOLE member account. Dedupe with enter-account-via-assume\
    \ on (CanEnterAccount, principal, member-account) \u2014 the engine keys emitted edges on (type, source,\
    \ target, scope), so the duplicate collapses. The Control Tower analogue (AWSControlTowerExecution)\
    \ is the sibling derivation aws-ct-execution-role-enter-account in rules/derived/aws/controltower.yaml."
  false_positive_note: "Only fires for the MANAGEMENT account's principals assuming a MEMBER account's\
    \ OAAR (the default admin direction). A member-account principal does NOT get this. Honor the trust:\
    \ the trust must actually permit ?principal (root of mgmt account permits any mgmt principal with\
    \ sts:AssumeRole granted by their own IAM policy). If the member has an SCP denying sts:AssumeRole,\
    \ keep BLOCKED. OAAR only exists in accounts Organizations CREATED (not INVITED) and the role name\
    \ is customizable \u2014 the second match clause depends on the explicit CrossAccountTrust FACT, which\
    \ is emitted only when iam:GetRole confirms the role and its trust."
  narrative: '{principal.name} in the management account can assume OrganizationAccountAccessRole in member
    account {target.name} and obtain AdministratorAccess, entering {target.name} as a full administrator.'