rage.fail

aws-lambda-can-invoke

explicit aws emits CanInvoke

match (effective permission)

{ "action": "lambda:InvokeFunction", "resource_type": "AWS::Lambda::Function" }

emit

source type	`Identity`
source	`<principal>`
target	`<function node>`
permissions	`lambda:InvokeFunction`

Narrative

{principal.name} can invoke {function.name} (lambda:InvokeFunction).

Raw rule rules/explicit/aws-lambda.yaml

id: aws-lambda-can-invoke
emits: CanInvoke
applies_to:
- aws
match_effective_permission:
  action: lambda:InvokeFunction
  resource_type: AWS::Lambda::Function
emit:
  source_type: Identity
  source: <principal>
  target: <function node>
  permissions:
  - lambda:InvokeFunction
  narrative: '{principal.name} can invoke {function.name} (lambda:InvokeFunction).'