aws-datapipeline-pipeline-executes-as-pipeline-role
Explicit extraction: the Data Pipeline service assumes the role specified in the role field.
match (record)
{
"field": "pipelineObjects[type=Default].role",
"resource_type": "AWS::DataPipeline::Pipeline"
}
emit
| source type | Messaging |
|---|---|
| target type | Role |
| source | <pipeline Workflow node> |
| target | <role IAM role ARN> |
Narrative
Pipeline {pipeline.name} uses {role.name} as its service role (role field) for resource provisioning.
Raw rule rules/explicit/aws-datapipeline.yaml
id: aws-datapipeline-pipeline-executes-as-pipeline-role
emits: ExecutesAs
description: 'Explicit extraction: the Data Pipeline service assumes the role specified in the role field.'
match_record:
resource_type: AWS::DataPipeline::Pipeline
field: pipelineObjects[type=Default].role
emit:
source_type: Messaging
target_type: Role
source: <pipeline Workflow node>
target: <role IAM role ARN>
api_source: datapipeline:GetPipelineDefinition
evidence_field: pipelineObjects[type=Default].fields[id=role].stringValue
narrative: Pipeline {pipeline.name} uses {role.name} as its service role (role field) for resource provisioning.