rage.fail

aws-cloudhsm-eni-attached-to-hsm

explicit aws emits AttachedTo

match (record)

{ "field": "InterfaceType", "resource_type": "AWS::EC2::NetworkInterface" }

where

ENI belongs to a CloudHSM HSM (EniId from DescribeClusters Hsms[])

emit

source	`<HSM ENI node>`
target	`<HSM node>`

Narrative

HSM ENI {eni.name} is attached to CloudHSM instance {hsm.name}.

Raw rule rules/explicit/aws-cloudhsm.yaml

id: aws-cloudhsm-eni-attached-to-hsm
emits: AttachedTo
applies_to:
- aws
match_record:
  resource_type: AWS::EC2::NetworkInterface
  field: InterfaceType
where:
- ENI belongs to a CloudHSM HSM (EniId from DescribeClusters Hsms[])
emit:
  source: <HSM ENI node>
  target: <HSM node>
  api_source: cloudhsm:DescribeClusters | ec2:DescribeNetworkInterfaces
  evidence_field: Hsms[].EniId
  narrative: HSM ENI {eni.name} is attached to CloudHSM instance {hsm.name}.