rage.fail

aws-lightsail-open-public-ports

derived aws emits ExposedToInternet

match (effective permission)

{ "action": "lightsail:OpenInstancePublicPorts", "resource_type": "AWS::Lightsail::Instance" }

emit

target type	`AnonymousIdentity`
source	`<Lightsail instance in scope>`
target	`<AnonymousIdentity>`
permissions	`lightsail:OpenInstancePublicPorts` `lightsail:PutInstancePublicPorts?`
conditions	`condition_expression`
state logic	ACTIVE if a port is opened to 0.0.0.0/0 else CONDITIONAL(condition_expression on cidr)

Narrative

Instance {source.name} can be opened to the internet via lightsail:OpenInstancePublicPorts / PutInstancePublicPorts (firewall ports opened to 0.0.0.0/0).

Raw rule rules/derived/aws/lightsail.yaml

id: aws-lightsail-open-public-ports
emits: ExposedToInternet
match_effective_permission:
  action: lightsail:OpenInstancePublicPorts
  resource_type: AWS::Lightsail::Instance
optional_permission: lightsail:PutInstancePublicPorts
emit:
  target_type: AnonymousIdentity
  source: <Lightsail instance in scope>
  target: <AnonymousIdentity>
  permissions:
  - lightsail:OpenInstancePublicPorts
  - lightsail:PutInstancePublicPorts?
  conditions:
  - condition_expression
  state_logic: ACTIVE if a port is opened to 0.0.0.0/0 else CONDITIONAL(condition_expression on cidr)
  false_positive_note: Only ExposedToInternet when the opened CIDR is 0.0.0.0/0 (or ::/0). A restricted
    CIDR is not internet exposure - emit CanNetworkReach scoped to that CIDR instead.
  narrative: Instance {source.name} can be opened to the internet via lightsail:OpenInstancePublicPorts
    / PutInstancePublicPorts (firewall ports opened to 0.0.0.0/0).