rage.fail

aws-ct-execution-role-trust

explicit aws emits CrossAccountTrust

match (record)

{ "field": "AssumeRolePolicyDocument", "resource_type": "AWS::IAM::Role" }

where

role name == 'AWSControlTowerExecution' (deployed by CT into every enrolled member account) the trust policy Principal names the Organizations management account root (arn:aws:iam::<mgmt>:root)

emit

source	`<AWSControlTowerExecution role trust policy (in member account)>`
target	`<management Account boundary node>`

Narrative

AWSControlTowerExecution in account {account.name} trusts the management account {mgmt.name} to assume it (full AdministratorAccess).

Raw rule rules/explicit/aws-controltower.yaml

id: aws-ct-execution-role-trust
emits: CrossAccountTrust
applies_to:
- aws
match_record:
  resource_type: AWS::IAM::Role
  field: AssumeRolePolicyDocument
where:
- role name == 'AWSControlTowerExecution' (deployed by CT into every enrolled member account)
- the trust policy Principal names the Organizations management account root (arn:aws:iam::<mgmt>:root)
emit:
  source: <AWSControlTowerExecution role trust policy (in member account)>
  target: <management Account boundary node>
  api_source: iam:GetRole (AssumeRolePolicyDocument)
  evidence_field: AssumeRolePolicyDocument.Statement[].Principal.AWS
  narrative: AWSControlTowerExecution in account {account.name} trusts the management account {mgmt.name}
    to assume it (full AdministratorAccess).