rage.fail

aws-lf-existing-grants

explicit aws emits HasPermission

match (record)

{ "field": "PrincipalResourcePermissions", "resource_type": "AWS::LakeFormation::Permission" }

emit

source type	`Identity`
target type	`*`
source	`<principal ARN from PrincipalResourcePermissions[].Principal.DataLakePrincipalIdentifier>`
target	`<DataWarehouse node (Glue table or database) or DataLake node (location)>`

Narrative

{principal.name} holds Lake Formation permission(s) {permissions} on {resource.name}, confirmed by lakeformation:ListPermissions (GrantOption: {grant_option}).

Raw rule rules/explicit/aws-lakeformation.yaml

id: aws-lf-existing-grants
emits: HasPermission
applies_to:
- aws
match_record:
  resource_type: AWS::LakeFormation::Permission
  field: PrincipalResourcePermissions
emit:
  target_type: '*'
  source_type: Identity
  source: <principal ARN from PrincipalResourcePermissions[].Principal.DataLakePrincipalIdentifier>
  target: <DataWarehouse node (Glue table or database) or DataLake node (location)>
  api_source: lakeformation:ListPermissions
  evidence_field: PrincipalResourcePermissions[].Principal.DataLakePrincipalIdentifier + .Permissions[]
  note: Emit one HasPermission edge per (principal, resource) pair. Record Permissions[] (SELECT, INSERT,
    DESCRIBE, CREATE_TABLE, DATA_LOCATION_ACCESS, etc.) and PermissionsWithGrantOption[] as properties
    on the edge for downstream GRANT OPTION gate evaluation.
  narrative: '{principal.name} holds Lake Formation permission(s) {permissions} on {resource.name}, confirmed
    by lakeformation:ListPermissions (GrantOption: {grant_option}).'