rage.fail

aws-acm-can-read-getcertificate

explicit aws emits CanRead

match (effective permission)

{ "action": "acm:GetCertificate", "resource_type": "AWS::CertificateManager::Certificate" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<certificate node>`
permissions	`acm:GetCertificate`

Narrative

{principal.name} can read the public body + chain of certificate {cert.name} (acm:GetCertificate) - no private key.

Raw rule rules/explicit/aws-acm.yaml

id: aws-acm-can-read-getcertificate
emits: CanRead
applies_to:
- aws
match_effective_permission:
  action: acm:GetCertificate
  resource_type: AWS::CertificateManager::Certificate
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <certificate node>
  permissions:
  - acm:GetCertificate
  note: "acm:GetCertificate returns the PUBLIC certificate body + chain only, NOT the private key. Emit\
    \ CanRead (recon) ONLY \u2014 never CanReadSecret/CanExportKey."
  narrative: "{principal.name} can read the public body + chain of certificate {cert.name} (acm:GetCertificate)\
    \ \u2014 no private key."