aws-ebs-cross-account-snapshot-share
A snapshot is shared to an external AWS account via ec2:DescribeSnapshotAttribute.
match (record)
{
"field": "createVolumePermission.Add[].UserId",
"resource_type": "AWS::EC2::Snapshot"
}
emit
| source type | Snapshot |
|---|---|
| target type | Account |
| source | <snapshot node> |
| target | <Account node for the granted UserId> |
Narrative
{snapshot.name} grants createVolumePermission to external account {target.name}, enabling that account to create volumes from this snapshot (cross-account trust).
Raw rule rules/explicit/aws-ebs.yaml
id: aws-ebs-cross-account-snapshot-share
emits: CrossAccountTrust
applies_to:
- aws
description: A snapshot is shared to an external AWS account via ec2:DescribeSnapshotAttribute.
match_record:
resource_type: AWS::EC2::Snapshot
field: createVolumePermission.Add[].UserId
emit:
source_type: Snapshot
target_type: Account
source: <snapshot node>
target: <Account node for the granted UserId>
api_source: ec2:DescribeSnapshotAttribute
evidence_field: createVolumePermission.Add[].UserId
narrative: '{snapshot.name} grants createVolumePermission to external account {target.name}, enabling
that account to create volumes from this snapshot (cross-account trust).'