aws-neptune-snapshot-cross-account-trust
Neptune cluster snapshot is shared for restore with a specific external AWS account via neptune:DescribeDBClusterSnapshotAttributes (restore attribute contains account ID).
match (record)
{
"field": "DBClusterSnapshotAttributes[restore].AttributeValues",
"resource_type": "AWS::Neptune::DBClusterSnapshot"
}
where
AttributeValues contains a specific AWS account ID (not 'all')
emit
| source type | Snapshot |
|---|---|
| target type | Account |
| source | <Neptune cluster snapshot (Snapshot)> |
| target | <external AWS account (Account)> |
Narrative
Neptune cluster snapshot {snapshot.name} is shared for restore with account {accountId} - that account can call rds:RestoreDBClusterFromSnapshot to create a full copy of all graph data (vertices, edges, properties).
Raw rule rules/explicit/aws-neptune.yaml
id: aws-neptune-snapshot-cross-account-trust
emits: CrossAccountTrust
applies_to:
- aws
description: Neptune cluster snapshot is shared for restore with a specific external AWS account via neptune:DescribeDBClusterSnapshotAttributes
(restore attribute contains account ID).
match_record:
resource_type: AWS::Neptune::DBClusterSnapshot
field: DBClusterSnapshotAttributes[restore].AttributeValues
where:
- AttributeValues contains a specific AWS account ID (not 'all')
emit:
source_type: Snapshot
target_type: Account
source: <Neptune cluster snapshot (Snapshot)>
target: <external AWS account (Account)>
api_source: neptune:DescribeDBClusterSnapshotAttributes
evidence_field: DBClusterSnapshotAttributes[restore].AttributeValues
narrative: "Neptune cluster snapshot {snapshot.name} is shared for restore with account {accountId}\
\ \u2014 that account can call rds:RestoreDBClusterFromSnapshot to create a full copy of all graph\
\ data (vertices, edges, properties)."