rage.fail

aws-lf-registered-location-role

explicit aws emits ExecutesAs

match (record)

{ "field": "ResourceInfoList[].RoleArn", "resource_type": "AWS::LakeFormation::DataLake" }

emit

source type	`DataLake`
source	`<DataLake node for the registered S3 location (ResourceArn)>`
target	`<IAM Role node at RoleArn>`

Narrative

The Lake Formation registered location {location.arn} is associated with {role.name}; when analytics services (Athena / Glue / EMR) access this location, Lake Formation vends temporary credentials for {role.name} via lakeformation:GetDataAccess.

Raw rule rules/explicit/aws-lakeformation.yaml

id: aws-lf-registered-location-role
emits: ExecutesAs
applies_to:
- aws
match_record:
  resource_type: AWS::LakeFormation::DataLake
  field: ResourceInfoList[].RoleArn
emit:
  source_type: DataLake
  source: <DataLake node for the registered S3 location (ResourceArn)>
  target: <IAM Role node at RoleArn>
  api_source: lakeformation:ListResources
  evidence_field: ResourceInfoList[].RoleArn
  narrative: The Lake Formation registered location {location.arn} is associated with {role.name}; when
    analytics services (Athena / Glue / EMR) access this location, Lake Formation vends temporary credentials
    for {role.name} via lakeformation:GetDataAccess.