rage.fail

aws-cloudhsm-can-administer-cluster

explicit aws emits CanAdminister

match (effective permission)

{ "action_any": [ "cloudhsm:InitializeCluster", "cloudhsm:CreateHsm", "cloudhsm:DeleteHsm", "cloudhsm:DeleteCluster", "cloudhsm:ModifyCluster", "cloudhsm:ModifyBackupAttributes", "cloudhsm:RestoreBackup", "cloudhsm:DeleteBackup", "cloudhsm:CopyBackupToRegion" ], "resource_type": "AWS::CloudHSM::Cluster" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<cluster node>`
permissions	`cloudhsm:ModifyCluster` `cloudhsm:CreateHsm` `cloudhsm:DeleteHsm` `cloudhsm:RestoreBackup`

Narrative

{principal.name} can administer the CloudHSM cluster lifecycle of {cluster.name} (cloudhsm:* control-plane) - this does NOT grant key use.

Raw rule rules/explicit/aws-cloudhsm.yaml

id: aws-cloudhsm-can-administer-cluster
emits: CanAdminister
applies_to:
- aws
match_effective_permission:
  action_any:
  - cloudhsm:InitializeCluster
  - cloudhsm:CreateHsm
  - cloudhsm:DeleteHsm
  - cloudhsm:DeleteCluster
  - cloudhsm:ModifyCluster
  - cloudhsm:ModifyBackupAttributes
  - cloudhsm:RestoreBackup
  - cloudhsm:DeleteBackup
  - cloudhsm:CopyBackupToRegion
  resource_type: AWS::CloudHSM::Cluster
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <cluster node>
  api_source: iam:SimulatePrincipalPolicy | policy evaluation
  permissions:
  - cloudhsm:ModifyCluster
  - cloudhsm:CreateHsm
  - cloudhsm:DeleteHsm
  - cloudhsm:RestoreBackup
  narrative: "{principal.name} can administer the CloudHSM cluster lifecycle of {cluster.name} (cloudhsm:*\
    \ control-plane) \u2014 this does NOT grant key use."