aws-ds-trust-record

id: aws-ds-trust-record
emits: TrustsExternalIdentity
applies_to:
- aws
match_record:
  resource_type: AWS::DirectoryService::MicrosoftAD
  field: Trusts[].RemoteDomainName
where:
- TrustState == 'Verified'
- 'TrustDirection in [''One-Way: Trusting'', ''Two-Way'']'
emit:
  source_type: ResourcePolicy
  target_type: ExternalIdentity
  source: <ResourcePolicy node for this trust record (AD trust modeled as a ResourcePolicy artifact; generic_type
    ResourcePolicy, class Policy)>
  target: <ExternalIdentity node for Trusts[].RemoteDomainName>
  api_source: ds:DescribeTrusts
  evidence_field: TrustId, RemoteDomainName, TrustType (Forest|External), TrustDirection, TrustState
  record_property:
    node: <ResourcePolicy node for this trust>
    key: trust_direction
    value: <TrustDirection>
  narrative: 'Directory {directory.name} has a verified AD {trust.trust_type} trust to {trust.remote_domain_name}
    (direction: {trust.trust_direction}); Kerberos tickets from that domain are accepted by the managed
    domain controllers.'
  note: "Only emit when TrustDirection includes 'Trusting' \u2014 the AWS side accepts tickets FROM the\
    \ external domain. 'One-Way: Trusted' means AWS users can authenticate INTO the external domain (not\
    \ a risk to AWS resources; do not emit TrustsExternalIdentity for that direction). TrustState must\
    \ be 'Verified'; 'Failed' or 'Created' trusts are not yet functional. Feeds federation-chains.yaml\
    \ federation-maps-to-identity (CITED): if the external domain is attacker-controlled (on-prem compromise),\
    \ the trust yields CanFederateAs into the AWS-managed domain. SCHEMA NOTE: The AD trust record is\
    \ described throughout DS docs as a TrustPolicy node (AWS::DirectoryService::Trust), but TrustPolicy\
    \ is NOT in TrustsExternalIdentity.source set ([Role, ServiceAccount, ApplicationIdentity, ResourcePolicy]).\
    \ This is a schema gap: TrustPolicy should be added to TrustsExternalIdentity.source. Until then,\
    \ we model the trust as a ResourcePolicy artifact (a policy-like document that establishes a trust).\
    \ This re-modeling is acceptable because the trust record does function as an access-control artifact,\
    \ and federation-chains correctly consumes the TrustsExternalIdentity edge regardless of the source\
    \ node's internal class."