rage.fail

aws-ct-control-backing-scp

explicit aws emits HasPolicy

match (record)

{ "field": "ControlIdentifier", "resource_type": "AWS::ControlTower::EnabledControl" }

where

the control's behavior == PREVENTIVE (detective controls are AWS Config rules and back no SCP) resolve the backing Organizations ServiceControlPolicy the control materializes (aws-guardrails-* SCP attached at the target OU)

emit

source type	`*`
target type	`Policy`
source	`<EnabledControl Policy node>`
target	`<backing ServiceControlPolicy node (from Organizations adapter)>`

Narrative

Control Tower control {control.name} is backed by SCP guardrail {scp.name} (preventive control -> service control policy).

Raw rule rules/explicit/aws-controltower.yaml

id: aws-ct-control-backing-scp
emits: HasPolicy
applies_to:
- aws
match_record:
  resource_type: AWS::ControlTower::EnabledControl
  field: ControlIdentifier
where:
- the control's behavior == PREVENTIVE (detective controls are AWS Config rules and back no SCP)
- resolve the backing Organizations ServiceControlPolicy the control materializes (aws-guardrails-* SCP
  attached at the target OU)
emit:
  source_type: '*'
  target_type: Policy
  source: <EnabledControl Policy node>
  target: <backing ServiceControlPolicy node (from Organizations adapter)>
  api_source: controltower:GetEnabledControl / ListControlOperations + organizations:ListPolicies/DescribePolicy
  evidence_field: EnabledControl.ControlIdentifier -> Organizations Policy.Id
  false_positive_note: "Only PREVENTIVE controls back an SCP. Detective controls back a Config rule (emit\
    \ nothing here \u2014 they gate no edge). Reference the existing ServiceControlPolicy node from the\
    \ Organizations adapter; do not create a duplicate SCP node."
  narrative: Control Tower control {control.name} is backed by SCP guardrail {scp.name} (preventive control
    -> service control policy).