rage.fail

aws-lf-cross-account-opt-in

explicit aws emits CrossAccountTrust

match (record)

{ "field": "LakeFormationOptInsInfoList", "resource_type": "AWS::LakeFormation::OptIn" }

emit

source type	`ResourcePolicy`
source	`<LakeFormation OptIn record (ResourceArn + Principal)>`
target	`<foreign Account parsed from Principal ARN>`

Narrative

A Lake Formation OptIn record grants cross-account catalog access to principal {foreign_principal} in account {foreign_account}, enabling that account to query governed tables once the RAM share is accepted and the principal holds analytics service IAM permissions.

Raw rule rules/explicit/aws-lakeformation.yaml

id: aws-lf-cross-account-opt-in
emits: CrossAccountTrust
applies_to:
- aws
match_record:
  resource_type: AWS::LakeFormation::OptIn
  field: LakeFormationOptInsInfoList
emit:
  source_type: ResourcePolicy
  source: <LakeFormation OptIn record (ResourceArn + Principal)>
  target: <foreign Account parsed from Principal ARN>
  api_source: lakeformation:ListLakeFormationOptIns
  evidence_field: LakeFormationOptInsInfoList[].Principal.DataLakePrincipalIdentifier
  note: Parse the account ID from the Principal ARN. Only emit when the Principal ARN belongs to a different
    account than the data lake being collected.
  narrative: A Lake Formation OptIn record grants cross-account catalog access to principal {foreign_principal}
    in account {foreign_account}, enabling that account to query governed tables once the RAM share is
    accepted and the principal holds analytics service IAM permissions.