rage.fail

aws-memorydb-cluster-associated-with-acl-users

explicit aws emits Contains

match (effective permission)

{ "action": "memorydb:DescribeClusters", "resource_type": "AWS::MemoryDB::Cluster" }

where

?cluster.properties.ACLName is present

emit

source type	`Cache`
target type	`Credential`
source	`<cluster node>`
target	`<ACL user Credential node(s) in the cluster's ACL>`

Narrative

{cluster.name} is associated with ACL {acl.name}, which contains the ACL users ({user.name}) that can authenticate to the cluster. This is a structural containment relationship; the ExposesCredential capability is derived from this fact combined with the user's CredentialsFor link.

Raw rule rules/explicit/aws-memorydb.yaml

id: aws-memorydb-cluster-associated-with-acl-users
emits: Contains
applies_to:
- aws
match_effective_permission:
  action: memorydb:DescribeClusters
  resource_type: AWS::MemoryDB::Cluster
where:
- ?cluster.properties.ACLName is present
emit:
  source_type: Cache
  target_type: Credential
  source: <cluster node>
  target: <ACL user Credential node(s) in the cluster's ACL>
  api_source: memorydb:DescribeClusters + memorydb:DescribeACLs + memorydb:DescribeUsers
  evidence_field: cluster.ACLName -> ACL.UserNames -> individual Credential nodes
  record_property:
    node: <cluster node>
    key: associated_acl_users
    value: <list of User names from DescribeACLs for this cluster's ACL>
  narrative: '{cluster.name} is associated with ACL {acl.name}, which contains the ACL users ({user.name})
    that can authenticate to the cluster. This is a structural containment relationship; the ExposesCredential
    capability is derived from this fact combined with the user''s CredentialsFor link.'