aws-cfn-stacksets-org-enter

cloudformation:CreateStackSet/UpdateStackSet with SERVICE_MANAGED permission model (Organizations integration) deploys to all Org member accounts - equivalent to organization-wide foothold.

derived aws emits CanEnterOrganization

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'stack_set': None}

where

node_type(?stack_set) == GenericCompute # AWS::CloudFormation::StackSet ?stack_set.PermissionModel == SERVICE_MANAGED ?principal has EFFECTIVE cloudformation:CreateStackSet OR cloudformation:UpdateStackSet on ?stack_set ?principal is a delegated StackSets administrator (organizations:RegisterDelegatedAdministrator or management account)

emit

source type	`Identity`
target type	`Organization`
source	`?principal`
target	`<AWS Organization the stack set targets>`
permissions	`cloudformation:CreateStackSet` `cloudformation:UpdateStackSet`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when ?principal is the management account or has delegated admin status (organizations:RegisterDelegatedAdministrator already granted), AND cloudformation:CreateStackSet/UpdateStackSet is in EFFECTIVE policy for the stack set with SERVICE_MANAGED model, AND target OUs/accounts are set to ALL (deployment targets include all Org members). CONDITIONAL(scp_or_org_policy) when SCPs or organizational policies restrict StackSets reach to a subset of accounts. BLOCKED if StackSets trust delegation was revoked or the management account explicitly denied this principal's access to StackSets administration.

Narrative

{principal.name} can create or update a service-managed CloudFormation StackSet (Organizations integration), deploying templates to all member accounts of the AWS Organization using CloudFormation's service-linked role - a foothold across the entire Organization.

Raw rule rules/derived/aws/cloudformation.yaml

id: aws-cfn-stacksets-org-enter
emits: CanEnterOrganization
description: "cloudformation:CreateStackSet/UpdateStackSet with SERVICE_MANAGED permission model (Organizations\
  \ integration) deploys to all Org member accounts \u2014 equivalent to organization-wide foothold."
match:
- - principal: null
  - HasPermission
  - stack_set: null
where:
- 'node_type(?stack_set) == GenericCompute  # AWS::CloudFormation::StackSet'
- ?stack_set.PermissionModel == SERVICE_MANAGED
- ?principal has EFFECTIVE cloudformation:CreateStackSet OR cloudformation:UpdateStackSet on ?stack_set
- ?principal is a delegated StackSets administrator (organizations:RegisterDelegatedAdministrator or management
  account)
emit:
  source_type: Identity
  target_type: Organization
  source: ?principal
  target: <AWS Organization the stack set targets>
  permissions:
  - cloudformation:CreateStackSet
  - cloudformation:UpdateStackSet
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when ?principal is the management account or has delegated admin status (organizations:RegisterDelegatedAdministrator
    already granted), AND cloudformation:CreateStackSet/UpdateStackSet is in EFFECTIVE policy for the
    stack set with SERVICE_MANAGED model, AND target OUs/accounts are set to ALL (deployment targets include
    all Org members). CONDITIONAL(scp_or_org_policy) when SCPs or organizational policies restrict StackSets
    reach to a subset of accounts. BLOCKED if StackSets trust delegation was revoked or the management
    account explicitly denied this principal's access to StackSets administration.
  confidence: 0.88
  derived_from:
  - cloudformation:CreateStackSet/UpdateStackSet EFFECTIVE on SERVICE_MANAGED stack set
  - ?principal is delegated StackSets admin OR management account
  false_positive_note: "SERVICE_MANAGED StackSets require delegated admin status or management-account\
    \ privileges \u2014 verify via organizations:ListDelegatedAdministrators. A principal with only cloudformation\
    \ permissions but NOT delegated admin status cannot create service-managed stack sets. The SLR used\
    \ by CloudFormation in member accounts has broad permissions but may be restricted by SCPs in members.\
    \ Emit CanEnterOrganization only when deployment targets cover all/most Org members; narrow targets\
    \ (single OU or account) => emit CanEnterAccount(s) instead."
  narrative: "{principal.name} can create or update a service-managed CloudFormation StackSet (Organizations\
    \ integration), deploying templates to all member accounts of the AWS Organization using CloudFormation's\
    \ service-linked role \u2014 a foothold across the entire Organization."