rage.fail

aws-kms-grant-cross-account

explicit aws emits CrossAccountTrust

match (record)

{ "field": "GranteePrincipal", "resource_type": "AWS::KMS::Grant" }

where

GranteePrincipal is in a different account

emit

source	`<key-policy ResourcePolicy node>`
target	`<external grantee principal / account>`

Narrative

{key.name} has a grant delegating {operations} to {external.name} in account {account}.

Raw rule rules/explicit/aws-kms.yaml

id: aws-kms-grant-cross-account
emits: CrossAccountTrust
applies_to:
- aws
match_record:
  resource_type: AWS::KMS::Grant
  field: GranteePrincipal
where:
- GranteePrincipal is in a different account
emit:
  source: <key-policy ResourcePolicy node>
  target: <external grantee principal / account>
  api_source: kms:ListGrants
  evidence_field: GranteePrincipal
  narrative: '{key.name} has a grant delegating {operations} to {external.name} in account {account}.'