rage.fail

aws-acm-inuseby-reference

explicit aws emits ContainsResourceReference

match (record)

{ "field": "InUseBy", "resource_type": "AWS::CertificateManager::Certificate" }

where

InUseBy array is non-empty node_class(consumer) in [Compute, Storage] # e.g. App Runner service (Compute); skip Network-class consumers (ELB/CloudFront) here

emit

target type	`*`
source	`<consuming resource node (Compute/Storage-class, e.g. App Runner service)>`
target	`<certificate node>`

Narrative

{consumer.name} references certificate {cert.name} (recon: an endpoint a stolen key would impersonate).

Raw rule rules/explicit/aws-acm.yaml

id: aws-acm-inuseby-reference
emits: ContainsResourceReference
applies_to:
- aws
match_record:
  resource_type: AWS::CertificateManager::Certificate
  field: InUseBy
where:
- InUseBy array is non-empty
- 'node_class(consumer) in [Compute, Storage]  # e.g. App Runner service (Compute); skip Network-class
  consumers (ELB/CloudFront) here'
emit:
  target_type: '*'
  source: <consuming resource node (Compute/Storage-class, e.g. App Runner service)>
  target: <certificate node>
  api_source: acm:DescribeCertificate
  evidence_field: Certificate.InUseBy[]
  note: "Recon only (traversal: walkable=false). Reversed from the old Certificate->consumer direction,\
    \ which violated the ContainsResourceReference source set (Certificate is Secret-class, not Data/Storage/Compute).\
    \ Network-class consumers (ELB/CloudFront) are intentionally NOT emitted here \u2014 their own service\
    \ rules own that reference edge."
  narrative: '{consumer.name} references certificate {cert.name} (recon: an endpoint a stolen key would
    impersonate).'