aws-datapipeline-pipeline-executes-as-resource-role
Explicit extraction: a pipeline's EC2 or EMR resource node runs as the IAM role specified in the resourceRole field.
match (record)
{
"field": "pipelineObjects[type=Ec2Resource or type=EmrCluster].resourceRole",
"resource_type": "AWS::DataPipeline::Pipeline"
}
emit
| source type | Compute |
|---|---|
| target type | Role |
| source | <EC2Resource or EmrCluster compute node> |
| target | <resourceRole IAM role ARN> |
Narrative
Pipeline {pipeline.name}'s resource node runs as {role.name} (resourceRole field).
Raw rule rules/explicit/aws-datapipeline.yaml
id: aws-datapipeline-pipeline-executes-as-resource-role
emits: ExecutesAs
description: 'Explicit extraction: a pipeline''s EC2 or EMR resource node runs as the IAM role specified
in the resourceRole field.'
match_record:
resource_type: AWS::DataPipeline::Pipeline
field: pipelineObjects[type=Ec2Resource or type=EmrCluster].resourceRole
emit:
source_type: Compute
target_type: Role
source: <EC2Resource or EmrCluster compute node>
target: <resourceRole IAM role ARN>
api_source: datapipeline:GetPipelineDefinition
evidence_field: pipelineObjects[type=Ec2Resource|EmrCluster].fields[id=resourceRole].stringValue
narrative: Pipeline {pipeline.name}'s resource node runs as {role.name} (resourceRole field).