rage.fail

aws-lf-list-permissions-recon

explicit aws emits CanRead

match (effective permission)

{ "action": "lakeformation:ListPermissions", "resource_type": "AWS::LakeFormation::DataLake" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<DataLake node>`
permissions	`lakeformation:ListPermissions`

Narrative

{principal.name} has effective lakeformation:ListPermissions and can enumerate all Lake Formation permission grants (principal ARNs, resources, permission types, GRANT OPTION flags) - high-value recon for mapping who has data access.

Raw rule rules/explicit/aws-lakeformation.yaml

id: aws-lf-list-permissions-recon
emits: CanRead
applies_to:
- aws
match_effective_permission:
  action: lakeformation:ListPermissions
  resource_type: AWS::LakeFormation::DataLake
emit:
  target_type: '*'
  source_type: Identity
  source: <principal>
  target: <DataLake node>
  permissions:
  - lakeformation:ListPermissions
  narrative: "{principal.name} has effective lakeformation:ListPermissions and can enumerate all Lake\
    \ Formation permission grants (principal ARNs, resources, permission types, GRANT OPTION flags) \u2014\
    \ high-value recon for mapping who has data access."