aws-ebs-volume-attachment
A volume is attached to an EC2 instance via ec2:DescribeVolumes.
match (record)
{
"field": "Attachments[].InstanceId",
"resource_type": "AWS::EC2::Volume"
}
emit
| source type | BlockStorage |
|---|---|
| target type | VirtualMachine |
| source | <volume node> |
| target | <instance node> |
Narrative
{volume.name} is attached to {instance.name} as device {Attachments[].Device}; the volume's data is accessible to the instance and its IAM role.
Raw rule rules/explicit/aws-ebs.yaml
id: aws-ebs-volume-attachment
emits: AttachedTo
applies_to:
- aws
description: A volume is attached to an EC2 instance via ec2:DescribeVolumes.
match_record:
resource_type: AWS::EC2::Volume
field: Attachments[].InstanceId
emit:
source_type: BlockStorage
target_type: VirtualMachine
source: <volume node>
target: <instance node>
api_source: ec2:DescribeVolumes
evidence_field: Attachments[].InstanceId
narrative: '{volume.name} is attached to {instance.name} as device {Attachments[].Device}; the volume''s
data is accessible to the instance and its IAM role.'