rage.fail

aws-cloudhsm-host-contains-cu-cred

explicit aws emits ContainsCredential

match (record)

{ "field": "PinMaterial", "resource_type": "CloudHSM::ClientHostConfig" }

where

host stores a CU/CO login (hard-coded pin, pin file, mgmt_util config)

emit

source	`<client host node (Compute)>`
target	`<HSM CU/CO login credential node>`

Narrative

{host.name} stores a CloudHSM Crypto User login {cred.name} in its configuration.

Raw rule rules/explicit/aws-cloudhsm.yaml

id: aws-cloudhsm-host-contains-cu-cred
emits: ContainsCredential
applies_to:
- aws
match_record:
  resource_type: CloudHSM::ClientHostConfig
  field: PinMaterial
where:
- host stores a CU/CO login (hard-coded pin, pin file, mgmt_util config)
emit:
  source: <client host node (Compute)>
  target: <HSM CU/CO login credential node>
  api_source: host inventory (env/config file scan)
  evidence_field: CLOUDHSM_PIN / pkcs11 pin file / cloudhsm_mgmt_util config
  narrative: '{host.name} stores a CloudHSM Crypto User login {cred.name} in its configuration.'