rage.fail

aws-ct-control-attached-to-ou

explicit aws emits HasPolicy

match (record)

{ "field": "TargetIdentifier", "resource_type": "AWS::ControlTower::EnabledControl" }

where

TargetIdentifier resolves to a registered OU (Folder) boundary node

emit

source type	`*`
target type	`Policy`
source	`<OU (Folder) boundary node from Organizations adapter>`
target	`<EnabledControl Policy node>`

Narrative

OU {ou.name} has Control Tower control {control.name} attached, inheriting to every account within it.

Raw rule rules/explicit/aws-controltower.yaml

id: aws-ct-control-attached-to-ou
emits: HasPolicy
applies_to:
- aws
match_record:
  resource_type: AWS::ControlTower::EnabledControl
  field: TargetIdentifier
where:
- TargetIdentifier resolves to a registered OU (Folder) boundary node
emit:
  source_type: '*'
  target_type: Policy
  source: <OU (Folder) boundary node from Organizations adapter>
  target: <EnabledControl Policy node>
  api_source: controltower:GetEnabledControl (TargetIdentifier)
  evidence_field: EnabledControl.TargetIdentifier
  narrative: OU {ou.name} has Control Tower control {control.name} attached, inheriting to every account
    within it.