rage.fail

aws-account-oaar-trust-policy

explicit aws emits HasPolicy

match (record)

{ "field": "AssumeRolePolicyDocument", "resource_type": "AWS::IAM::Role" }

where

RoleName == 'OrganizationAccountAccessRole' # or the org's configured cross-account admin role AssumeRolePolicyDocument.Statement[].Principal.AWS matches arn:aws:iam::<management-account-id>:root

emit

source type	`*`
target type	`Policy`
source	`<OrganizationAccountAccessRole node>`
target	`<TrustPolicy node parsed from AssumeRolePolicyDocument>`

Narrative

{role.name} trusts the management account root (arn:aws:iam::<mgmt>:root) via its assume-role trust policy.

Raw rule rules/explicit/aws-account.yaml

id: aws-account-oaar-trust-policy
emits: HasPolicy
applies_to:
- aws
match_record:
  resource_type: AWS::IAM::Role
  field: AssumeRolePolicyDocument
where:
- 'RoleName == ''OrganizationAccountAccessRole''  # or the org''s configured cross-account admin role'
- AssumeRolePolicyDocument.Statement[].Principal.AWS matches arn:aws:iam::<management-account-id>:root
emit:
  source_type: '*'
  target_type: Policy
  source: <OrganizationAccountAccessRole node>
  target: <TrustPolicy node parsed from AssumeRolePolicyDocument>
  api_source: iam:GetRole
  evidence_field: AssumeRolePolicyDocument
  narrative: '{role.name} trusts the management account root (arn:aws:iam::<mgmt>:root) via its assume-role
    trust policy.'