rage.fail

aws-account-oaar-admin-policy

explicit aws emits HasPolicy

match (record)

{ "field": "AttachedManagedPolicies", "resource_type": "AWS::IAM::Role" }

where

RoleName == 'OrganizationAccountAccessRole' AttachedManagedPolicies[].PolicyArn == 'arn:aws:iam::aws:policy/AdministratorAccess'

emit

source type	`*`
target type	`Policy`
source	`<OrganizationAccountAccessRole node>`
target	`<AdministratorAccess managed policy node>`

Narrative

{role.name} has AdministratorAccess attached (default for OrganizationAccountAccessRole).

Raw rule rules/explicit/aws-account.yaml

id: aws-account-oaar-admin-policy
emits: HasPolicy
applies_to:
- aws
match_record:
  resource_type: AWS::IAM::Role
  field: AttachedManagedPolicies
where:
- RoleName == 'OrganizationAccountAccessRole'
- AttachedManagedPolicies[].PolicyArn == 'arn:aws:iam::aws:policy/AdministratorAccess'
emit:
  source_type: '*'
  target_type: Policy
  source: <OrganizationAccountAccessRole node>
  target: <AdministratorAccess managed policy node>
  api_source: iam:ListAttachedRolePolicies
  evidence_field: AttachedManagedPolicies
  narrative: '{role.name} has AdministratorAccess attached (default for OrganizationAccountAccessRole).'