rage.fail

aws-lf-put-datalake-settings-permission

explicit aws emits HasPermission

match (effective permission)

{ "action": "lakeformation:PutDataLakeSettings", "resource_type": "AWS::LakeFormation::DataLake" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<DataLake node>`
permissions	`lakeformation:PutDataLakeSettings`

Narrative

{principal.name} has effective lakeformation:PutDataLakeSettings on the data lake; derived rule aws-lf-put-datalake-settings-admin produces CanAdminister.

Raw rule rules/explicit/aws-lakeformation.yaml

id: aws-lf-put-datalake-settings-permission
emits: HasPermission
applies_to:
- aws
match_effective_permission:
  action: lakeformation:PutDataLakeSettings
  resource_type: AWS::LakeFormation::DataLake
emit:
  target_type: '*'
  source_type: Identity
  source: <principal>
  target: <DataLake node>
  permissions:
  - lakeformation:PutDataLakeSettings
  note: "lakeformation:PutDataLakeSettings is only resource-scopeable to '*'; confirm the IAM policy does\
    \ not scope it to a non-wildcard resource (which would be a mis-configuration \u2014 the action always\
    \ operates account-wide)."
  narrative: '{principal.name} has effective lakeformation:PutDataLakeSettings on the data lake; derived
    rule aws-lf-put-datalake-settings-admin produces CanAdminister.'