aws-account-oaar-crossaccount-trust

id: aws-account-oaar-crossaccount-trust
emits: CrossAccountTrust
applies_to:
- aws
match_record:
  resource_type: AWS::IAM::Role
  field: AssumeRolePolicyDocument
where:
- 'RoleName == ''OrganizationAccountAccessRole''  # or the org''s configured cross-account admin role'
- AssumeRolePolicyDocument.Statement[].Principal.AWS matches arn:aws:iam::<management-account-id>:root
- "the role carries AdministratorAccess (see aws-account-oaar-admin-policy) \u2014 default for OAAR"
emit:
  source: "<OrganizationAccountAccessRole node (member account) \u2014 a Role>"
  target: <management Account node named by the trust Principal.AWS root ARN>
  api_source: iam:GetRole
  evidence_field: AssumeRolePolicyDocument.Statement[].Principal.AWS
  permissions: []
  conditions:
  - trust_relationship
  false_positive_note: OrganizationAccountAccessRole is created ONLY in accounts that Organizations CREATED
    (organizations:CreateAccount), NOT in accounts INVITED into the org, and the role name is customizable.
    Emit ONLY when iam:GetRole actually returns the role with a trust naming the management root; never
    assume it exists. If the trust was edited to drop mgmt-root (CanModifyTrust abuse) the fact is stale
    -> do not emit.
  narrative: OrganizationAccountAccessRole in member account {source.account} trusts the management account
    {target.name} root with AdministratorAccess (arn:aws:iam::<mgmt>:root).