rage.fail

aws-lightsail-get-bucket-access-keys

derived aws emits CanReadSecret

match (effective permission)

{ "action": "lightsail:GetBucketAccessKeys", "resource_type": "AWS::Lightsail::Bucket" }

emit

source	`<principal>`
target	`<Lightsail bucket in scope>`
permissions	`lightsail:GetBucketAccessKeys`

Narrative

{principal.name} can read the access keys of bucket {target.name} (lightsail:GetBucketAccessKeys).

Raw rule rules/derived/aws/lightsail.yaml

id: aws-lightsail-get-bucket-access-keys
emits: CanReadSecret
match_effective_permission:
  action: lightsail:GetBucketAccessKeys
  resource_type: AWS::Lightsail::Bucket
emit:
  source: <principal>
  target: <Lightsail bucket in scope>
  permissions:
  - lightsail:GetBucketAccessKeys
  escalation: Read existing bucket access keys -> direct data-plane access.
  narrative: '{principal.name} can read the access keys of bucket {target.name} (lightsail:GetBucketAccessKeys).'