rage.fail

aws-lf-admin-list

explicit aws emits HasPermission

match (record)

{ "field": "DataLakeSettings.DataLakeAdmins", "resource_type": "AWS::LakeFormation::DataLake" }

emit

source type	`Identity`
target type	`*`
source	`<principal ARN in DataLakeAdmins list>`
target	`<DataLake node>`

Narrative

{principal.name} is listed as a Lake Formation DataLakeAdmin; ALL Lake Formation permission checks are bypassed for this principal account-wide.

Raw rule rules/explicit/aws-lakeformation.yaml

id: aws-lf-admin-list
emits: HasPermission
applies_to:
- aws
match_record:
  resource_type: AWS::LakeFormation::DataLake
  field: DataLakeSettings.DataLakeAdmins
emit:
  target_type: '*'
  source_type: Identity
  source: <principal ARN in DataLakeAdmins list>
  target: <DataLake node>
  api_source: lakeformation:GetDataLakeSettings
  evidence_field: DataLakeSettings.DataLakeAdmins[].DataLakePrincipalIdentifier
  narrative: '{principal.name} is listed as a Lake Formation DataLakeAdmin; ALL Lake Formation permission
    checks are bypassed for this principal account-wide.'