rage.fail

aws-acmpca-ca-has-policy

explicit aws emits HasPolicy

match (record)

{ "field": "Policy", "resource_type": "AWS::ACMPCA::CertificateAuthority" }

where

CA has a resource-based policy (GetPolicy returned a document)

emit

source type	`*`
target type	`Policy`
source	`<certificate-authority node>`
target	`<CA resource-policy node>`

Narrative

{ca.name} has a resource-based policy governing who may issue certificates.

Raw rule rules/explicit/aws-acmpca.yaml

id: aws-acmpca-ca-has-policy
emits: HasPolicy
applies_to:
- aws
match_record:
  resource_type: AWS::ACMPCA::CertificateAuthority
  field: Policy
where:
- CA has a resource-based policy (GetPolicy returned a document)
emit:
  source_type: '*'
  target_type: Policy
  source: <certificate-authority node>
  target: <CA resource-policy node>
  api_source: acm-pca:GetPolicy
  evidence_field: Policy
  narrative: '{ca.name} has a resource-based policy governing who may issue certificates.'