rage.fail

aws-cloudhsm-account-contains-backup

explicit aws emits Contains

match (record)

{ "field": "BackupId", "resource_type": "AWS::CloudHSM::Backup" }

emit

source type	`AdministrativeBoundary`
target type	`*`
source	`<account/region boundary node>`
target	`<backup node (Data — encrypted key-material image)>`

Narrative

Account {account} contains CloudHSM backup {backup.name}.

Raw rule rules/explicit/aws-cloudhsm.yaml

id: aws-cloudhsm-account-contains-backup
emits: Contains
applies_to:
- aws
match_record:
  resource_type: AWS::CloudHSM::Backup
  field: BackupId
emit:
  source_type: AdministrativeBoundary
  target_type: '*'
  source: <account/region boundary node>
  target: "<backup node (Data \u2014 encrypted key-material image)>"
  api_source: cloudhsm:DescribeBackups
  evidence_field: BackupId
  narrative: Account {account} contains CloudHSM backup {backup.name}.