rage.fail

aws-acmpca-resource-policy-cross-account

explicit aws emits CrossAccountTrust

match (record)

{ "field": "Policy", "resource_type": "AWS::ACMPCA::CertificateAuthority" }

where

a Policy statement names a principal in a different account statement Action includes acm-pca:IssueCertificate

emit

source	`<CA resource-policy node>`
target	`<external principal / account>`

Narrative

{ca.name} resource policy grants acm-pca:IssueCertificate to {external.name} in account {account}.

Raw rule rules/explicit/aws-acmpca.yaml

id: aws-acmpca-resource-policy-cross-account
emits: CrossAccountTrust
applies_to:
- aws
match_record:
  resource_type: AWS::ACMPCA::CertificateAuthority
  field: Policy
where:
- a Policy statement names a principal in a different account
- statement Action includes acm-pca:IssueCertificate
emit:
  source: <CA resource-policy node>
  target: <external principal / account>
  api_source: acm-pca:GetPolicy
  evidence_field: Policy.Statement[].Principal / Action
  narrative: '{ca.name} resource policy grants acm-pca:IssueCertificate to {external.name} in account
    {account}.'