rage.fail

aws-lambda-resource-policy-cross-account

explicit aws emits CrossAccountTrust

match (record)

{ "field": "Policy", "resource_type": "AWS::Lambda::Function" }

where

principal in Policy is in a different account

emit

source	`<function node>`
target	`<external principal / account>`

Narrative

{function.name} resource policy grants invoke to {external.name} in account {account}.

Raw rule rules/explicit/aws-lambda.yaml

id: aws-lambda-resource-policy-cross-account
emits: CrossAccountTrust
applies_to:
- aws
match_record:
  resource_type: AWS::Lambda::Function
  field: Policy
where:
- principal in Policy is in a different account
emit:
  source: <function node>
  target: <external principal / account>
  api_source: lambda:GetPolicy
  narrative: '{function.name} resource policy grants invoke to {external.name} in account {account}.'