rage.fail

aws-kms-has-key-policy

explicit aws emits HasPolicy

match (record)

{ "field": "Policy", "resource_type": "AWS::KMS::Key" }

emit

source type	`*`
target type	`Policy`
source	`<key node>`
target	`<key-policy ResourcePolicy node>`

Narrative

{key.name} has a key policy (resource policy) governing who may use it.

Raw rule rules/explicit/aws-kms.yaml

id: aws-kms-has-key-policy
emits: HasPolicy
applies_to:
- aws
match_record:
  resource_type: AWS::KMS::Key
  field: Policy
emit:
  source_type: '*'
  target_type: Policy
  source: <key node>
  target: <key-policy ResourcePolicy node>
  api_source: kms:GetKeyPolicy
  evidence_field: Policy
  narrative: '{key.name} has a key policy (resource policy) governing who may use it.'