aws-documentdb-snapshot-cross-account-trust
DocumentDB cluster snapshot is shared for restore with a specific external AWS account via rds:DescribeDBClusterSnapshotAttributes (restore attribute contains account ID).
match (record)
{
"field": "DBClusterSnapshotAttributes[restore].AttributeValues",
"resource_type": "AWS::DocDB::DBClusterSnapshot"
}
where
AttributeValues contains a specific AWS account ID (not 'all')
emit
| source type | Snapshot |
|---|---|
| target type | Account |
| source | <DocumentDB cluster snapshot (Snapshot)> |
| target | <external AWS account (Account)> |
Narrative
DocumentDB cluster snapshot {snapshot.name} is shared for restore with account {accountId} - that account can call rds:RestoreDBClusterFromSnapshot to create a full copy of all cluster data (all databases and collections).
Raw rule rules/explicit/aws-documentdb.yaml
id: aws-documentdb-snapshot-cross-account-trust
emits: CrossAccountTrust
applies_to:
- aws
description: DocumentDB cluster snapshot is shared for restore with a specific external AWS account via
rds:DescribeDBClusterSnapshotAttributes (restore attribute contains account ID).
match_record:
resource_type: AWS::DocDB::DBClusterSnapshot
field: DBClusterSnapshotAttributes[restore].AttributeValues
where:
- AttributeValues contains a specific AWS account ID (not 'all')
emit:
source_type: Snapshot
target_type: Account
source: <DocumentDB cluster snapshot (Snapshot)>
target: <external AWS account (Account)>
api_source: rds:DescribeDBClusterSnapshotAttributes
evidence_field: DBClusterSnapshotAttributes[restore].AttributeValues
narrative: "DocumentDB cluster snapshot {snapshot.name} is shared for restore with account {accountId}\
\ \u2014 that account can call rds:RestoreDBClusterFromSnapshot to create a full copy of all cluster\
\ data (all databases and collections)."