rage.fail

aws-ct-landingzone-locatedin-org

explicit aws emits LocatedIn

match (record)

{ "field": "Arn", "resource_type": "AWS::ControlTower::LandingZone" }

emit

source type	`*`
source	`<LandingZone node (ManagementService)>`
target	`<Organization boundary node (from Organizations adapter)>`

Narrative

{landing_zone.name} is the Control Tower landing zone governing organization {org.name}.

Raw rule rules/explicit/aws-controltower.yaml

id: aws-ct-landingzone-locatedin-org
emits: LocatedIn
applies_to:
- aws
match_record:
  resource_type: AWS::ControlTower::LandingZone
  field: Arn
emit:
  source_type: '*'
  source: <LandingZone node (ManagementService)>
  target: <Organization boundary node (from Organizations adapter)>
  api_source: controltower:GetLandingZone + organizations:DescribeOrganization
  evidence_field: LandingZone.Arn / DescribeOrganization.Id
  narrative: '{landing_zone.name} is the Control Tower landing zone governing organization {org.name}.'