rage.fail

aws-lf-can-grant-permission

explicit aws emits CanGrantPermission

match (effective permission)

{ "action": [ "lakeformation:GrantPermissions", "lakeformation:BatchGrantPermissions" ], "resource_type": "AWS::LakeFormation::DataLake" }

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<any IAM principal (incl. the source principal itself)>`
permissions	`lakeformation:GrantPermissions` `lakeformation:BatchGrantPermissions`

Narrative

{principal.name} has effective lakeformation:GrantPermissions and can grant Lake Formation data-lake permissions to any principal (subject to LF admin or GRANT OPTION gate per derived rule).

Raw rule rules/explicit/aws-lakeformation.yaml

id: aws-lf-can-grant-permission
emits: CanGrantPermission
applies_to:
- aws
match_effective_permission:
  action:
  - lakeformation:GrantPermissions
  - lakeformation:BatchGrantPermissions
  resource_type: AWS::LakeFormation::DataLake
emit:
  target_type: Identity
  source_type: Identity
  source: <principal>
  target: <any IAM principal (incl. the source principal itself)>
  permissions:
  - lakeformation:GrantPermissions
  - lakeformation:BatchGrantPermissions
  note: This edge asserts the IAM-layer grant capability. The LF-layer gate (LF admin or GRANT OPTION
    on the specific resource) is evaluated by derived rule aws-lf-grant-permissions-self before emitting
    a fully resolved CanGrantPermission. Emit state CONDITIONAL(resource_policy) when GRANT OPTION status
    is unconfirmed.
  narrative: '{principal.name} has effective lakeformation:GrantPermissions and can grant Lake Formation
    data-lake permissions to any principal (subject to LF admin or GRANT OPTION gate per derived rule).'