aws-ct-account-factory-enter

Creating a managed account via Account Factory yields a new account pre-seeded with an admin role the creator can assume - creation is entry.

derived aws emits CanEnterAccount

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanCreate {'account_factory': None}

where

?principal holds EFFECTIVE controltower:CreateManagedAccount OR servicecatalog:ProvisionProduct on the Account Factory product node_type(?account_factory) in [ManagementService (LandingZone), ServiceCatalogProduct (Account Factory)] ?principal is a management-account principal (Account Factory runs in the mgmt account)

emit

source type	`Identity`
target type	`Account`
source	`?principal`
target	`<newly-provisioned Account (synthetic / future node)>`
permissions	`controltower:CreateManagedAccount` `servicecatalog:ProvisionProduct` `sts:AssumeRole`
conditions	`iam_permission`
state logic	ACTIVE for the creation-as-entry capability when the principal holds controltower:CreateManagedAccount (or ProvisionProduct on the Account Factory product) unconditionally; CONDITIONAL(iam_permission) if gated. The new account ships with AWSControlTowerExecution trusting the mgmt account, so the creator (a mgmt-account principal) can immediately assume into it — the entry realizes via rule aws-ct-execution-role-enter-account once the account exists. POTENTIAL when the target account is prospective (not yet created).

Narrative

{principal.name} can provision a new managed account via Account Factory (controltower:CreateManagedAccount); the account ships with an assumable admin role, so {principal.name} enters it on creation.

Raw rule rules/derived/aws/controltower.yaml

id: aws-ct-account-factory-enter
emits: CanEnterAccount
description: "Creating a managed account via Account Factory yields a new account pre-seeded with an admin\
  \ role the creator can assume \u2014 creation is entry."
match:
- - principal: null
  - CanCreate
  - account_factory: null
where:
- ?principal holds EFFECTIVE controltower:CreateManagedAccount OR servicecatalog:ProvisionProduct on the
  Account Factory product
- node_type(?account_factory) in [ManagementService (LandingZone), ServiceCatalogProduct (Account Factory)]
- ?principal is a management-account principal (Account Factory runs in the mgmt account)
emit:
  source_type: Identity
  target_type: Account
  source: ?principal
  target: <newly-provisioned Account (synthetic / future node)>
  permissions:
  - controltower:CreateManagedAccount
  - servicecatalog:ProvisionProduct
  - sts:AssumeRole
  conditions:
  - iam_permission
  state_logic: "ACTIVE for the creation-as-entry capability when the principal holds controltower:CreateManagedAccount\
    \ (or ProvisionProduct on the Account Factory product) unconditionally; CONDITIONAL(iam_permission)\
    \ if gated. The new account ships with AWSControlTowerExecution trusting the mgmt account, so the\
    \ creator (a mgmt-account principal) can immediately assume into it \u2014 the entry realizes via\
    \ rule aws-ct-execution-role-enter-account once the account exists. POTENTIAL when the target account\
    \ is prospective (not yet created)."
  confidence: min(contributing_confidences) * 0.9
  derived_from:
  - <CanCreate / effective controltower:CreateManagedAccount>
  false_positive_note: Requires the Account Factory Service Catalog portfolio to be reachable by the principal
    (ProvisionProduct is gated by the portfolio's launch constraints) OR the controltower:CreateManagedAccount
    API permission. Provisioning is asynchronous and can fail policy validation; model the resulting account
    as a prospective (POTENTIAL) boundary until confirmed. Do not emit for principals holding only read
    (controltower:ListManagedAccounts) actions.
  narrative: '{principal.name} can provision a new managed account via Account Factory (controltower:CreateManagedAccount);
    the account ships with an assumable admin role, so {principal.name} enters it on creation.'