rage.fail

aws-cloudhsm-backup-references-cluster

explicit aws emits ContainsResourceReference

match (record)

{ "field": "ClusterId", "resource_type": "AWS::CloudHSM::Backup" }

where

backup belongs to a CloudHSM cluster (ClusterId from DescribeBackups)

emit

source type	`Data`
target type	`*`
source	`<backup node (Data)>`
target	`<cluster node>`

Narrative

CloudHSM backup {backup.name} is a backup of cluster {cluster.name}.

Raw rule rules/explicit/aws-cloudhsm.yaml

id: aws-cloudhsm-backup-references-cluster
emits: ContainsResourceReference
applies_to:
- aws
match_record:
  resource_type: AWS::CloudHSM::Backup
  field: ClusterId
where:
- backup belongs to a CloudHSM cluster (ClusterId from DescribeBackups)
emit:
  source_type: Data
  target_type: '*'
  source: <backup node (Data)>
  target: <cluster node>
  api_source: cloudhsm:DescribeBackups
  evidence_field: ClusterId
  narrative: CloudHSM backup {backup.name} is a backup of cluster {cluster.name}.