rage.fail

aws-ds-can-create-trust

explicit aws emits CanModifyTrust

match (effective permission)

{ "action": "ds:CreateTrust", "resource_type": "AWS::DirectoryService::MicrosoftAD" }

emit

source type	`Identity`
target type	`TrustPolicy`
source	`<principal>`
target	`<TrustPolicy node of the directory>`
permissions	`ds:CreateTrust`

Narrative

{principal.name} can create a new Active Directory trust relationship for directory {directory.name} (ds:CreateTrust), enabling cross-domain authentication from a domain the attacker controls.

Raw rule rules/explicit/aws-ds.yaml

id: aws-ds-can-create-trust
emits: CanModifyTrust
applies_to:
- aws
match_effective_permission:
  action: ds:CreateTrust
  resource_type: AWS::DirectoryService::MicrosoftAD
emit:
  source_type: Identity
  target_type: TrustPolicy
  source: <principal>
  target: <TrustPolicy node of the directory>
  api_source: iam:SimulatePrincipalPolicy | policy evaluation
  permissions:
  - ds:CreateTrust
  evidence_field: effective ds:CreateTrust on directory ARN
  narrative: '{principal.name} can create a new Active Directory trust relationship for directory {directory.name}
    (ds:CreateTrust), enabling cross-domain authentication from a domain the attacker controls.'
  note: Only applicable to AWS::DirectoryService::MicrosoftAD (Managed AD); Simple AD does not support
    trust relationships; AD Connector trusts live in the on-prem AD. Verify directory type before emitting.