rage.fail

aws-lambda-can-modify-code

explicit aws emits CanModifyCode

match (effective permission)

{ "action": "lambda:UpdateFunctionCode", "resource_type": "AWS::Lambda::Function" }

emit

source type	`Identity`
source	`<principal>`
target	`<function node>`
permissions	`lambda:UpdateFunctionCode`

Narrative

{principal.name} can modify code of {function.name} (lambda:UpdateFunctionCode).

Raw rule rules/explicit/aws-lambda.yaml

id: aws-lambda-can-modify-code
emits: CanModifyCode
applies_to:
- aws
match_effective_permission:
  action: lambda:UpdateFunctionCode
  resource_type: AWS::Lambda::Function
emit:
  source_type: Identity
  source: <principal>
  target: <function node>
  api_source: iam:SimulatePrincipalPolicy | policy evaluation
  permissions:
  - lambda:UpdateFunctionCode
  narrative: '{principal.name} can modify code of {function.name} (lambda:UpdateFunctionCode).'