rage.fail

aws-acmpca-ram-share-cross-account

explicit aws emits CrossAccountTrust

match (record)

{ "field": "resourceArns", "resource_type": "AWS::RAM::ResourceShare" }

where

shared resource ARN is an acm-pca certificate-authority share principal is a different account/OU

emit

source	`<CA RAM-share / resource-policy node>`
target	`<external principal / account>`

Narrative

{ca.name} is shared via AWS RAM to account {account}, enabling cross-account certificate issuance.

Raw rule rules/explicit/aws-acmpca.yaml

id: aws-acmpca-ram-share-cross-account
emits: CrossAccountTrust
applies_to:
- aws
match_record:
  resource_type: AWS::RAM::ResourceShare
  field: resourceArns
where:
- shared resource ARN is an acm-pca certificate-authority
- share principal is a different account/OU
emit:
  source: <CA RAM-share / resource-policy node>
  target: <external principal / account>
  api_source: ram:GetResourceShareAssociations | ram:ListResources
  evidence_field: resourceArns / principals
  narrative: '{ca.name} is shared via AWS RAM to account {account}, enabling cross-account certificate
    issuance.'