rage.fail

aws-ds-can-read-directory

explicit aws emits CanRead

match (effective permission)

{ "action": "ds:DescribeDirectories", "resource_type": "AWS::DirectoryService::MicrosoftAD" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<directory node>`
permissions	`ds:DescribeDirectories`

Narrative

{principal.name} can describe directory {directory.name} (ds:DescribeDirectories) - metadata access only.

Raw rule rules/explicit/aws-ds.yaml

id: aws-ds-can-read-directory
emits: CanRead
applies_to:
- aws
match_effective_permission:
  action: ds:DescribeDirectories
  resource_type: AWS::DirectoryService::MicrosoftAD
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <directory node>
  api_source: iam:SimulatePrincipalPolicy | policy evaluation
  permissions:
  - ds:DescribeDirectories
  narrative: "{principal.name} can describe directory {directory.name} (ds:DescribeDirectories) \u2014\
    \ metadata access only."