rage.fail

aws-cloudhsm-cluster-located-in-vpc

explicit aws emits LocatedIn

match (record)

{ "field": "VpcId", "resource_type": "AWS::CloudHSM::Cluster" }

emit

source type	`*`
source	`<cluster node>`
target	`<VPC / subnet network node>`

Narrative

CloudHSM cluster {cluster.name} is deployed in {vpc.name} (VPC-only reachability, TCP 2223-2225).

Raw rule rules/explicit/aws-cloudhsm.yaml

id: aws-cloudhsm-cluster-located-in-vpc
emits: LocatedIn
applies_to:
- aws
match_record:
  resource_type: AWS::CloudHSM::Cluster
  field: VpcId
emit:
  source_type: '*'
  source: <cluster node>
  target: <VPC / subnet network node>
  api_source: cloudhsm:DescribeClusters
  evidence_field: SubnetMapping / VpcId
  narrative: CloudHSM cluster {cluster.name} is deployed in {vpc.name} (VPC-only reachability, TCP 2223-2225).