rage.fail

aws-kms-key-policy-cross-account

explicit aws emits CrossAccountTrust

match (record)

{ "field": "Policy", "resource_type": "AWS::KMS::Key" }

where

a key-policy statement names a principal / account root in a different account

emit

source	`<key-policy ResourcePolicy node>`
target	`<external principal / account>`

Narrative

{key.name} key policy grants use to {external.name} in account {account}.

Raw rule rules/explicit/aws-kms.yaml

id: aws-kms-key-policy-cross-account
emits: CrossAccountTrust
applies_to:
- aws
match_record:
  resource_type: AWS::KMS::Key
  field: Policy
where:
- a key-policy statement names a principal / account root in a different account
emit:
  source: <key-policy ResourcePolicy node>
  target: <external principal / account>
  api_source: kms:GetKeyPolicy
  evidence_field: Policy.Statement[].Principal
  narrative: '{key.name} key policy grants use to {external.name} in account {account}.'