aws-ds-directory-member-of
match (record)
{
"field": "GroupMemberships",
"resource_type": "ds:User"
}
where
ds:EnableDirectoryDataAccess is active on the directory (IdentityDataAccessStatus == Enabled)
emit
| source type | HumanIdentity |
|---|---|
| target type | Group |
| source | <DirectoryUser node (HumanIdentity)> |
| target | <Group node (e.g. Domain Admins group node)> |
Narrative
Directory user {user.name} is a member of group {group.name} in directory {directory.name}, inheriting that group's access to domain-joined resources.
Raw rule rules/explicit/aws-ds.yaml
id: aws-ds-directory-member-of
emits: MemberOf
applies_to:
- aws
match_record:
resource_type: ds:User
field: GroupMemberships
where:
- ds:EnableDirectoryDataAccess is active on the directory (IdentityDataAccessStatus == Enabled)
emit:
source_type: HumanIdentity
target_type: Group
source: <DirectoryUser node (HumanIdentity)>
target: <Group node (e.g. Domain Admins group node)>
api_source: ds:ListGroupsForMember | ds:DescribeUsers (Identity Data Access API)
evidence_field: GroupMemberships[].GroupId / GroupMemberships[].GroupName
narrative: Directory user {user.name} is a member of group {group.name} in directory {directory.name},
inheriting that group's access to domain-joined resources.
note: "Identity Data Access must be enabled on the directory for these APIs to return data. Without\
\ it, group membership is only obtainable via LDAP (out-of-band). When membership data is unavailable,\
\ the derived rule aws-ds-escalate-via-domain-admin-reset cannot fire for specific users \u2014 conservatively\
\ emit a POTENTIAL edge rather than guessing. High-value groups to specifically model: 'Domain Admins',\
\ 'Enterprise Admins', 'Schema Admins', 'BUILTIN\\Administrators', 'Group Policy Creator Owners'."