rage.fail

aws-opensearch-can-read-domain-config

explicit aws emits CanRead

match (effective permission)

{ "action": [ "es:DescribeDomain", "es:DescribeDomains" ], "resource_type": "AWS::OpenSearchService::Domain" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<domain (SearchService)>`
permissions	`es:DescribeDomain`

Narrative

{principal.name} can read the configuration and endpoint of OpenSearch domain {domain.name} (es:DescribeDomain) - recon for the endpoint URL, VPC/FGAC settings, and access policy.

Raw rule rules/explicit/aws-opensearch.yaml

id: aws-opensearch-can-read-domain-config
emits: CanRead
applies_to:
- aws
match_effective_permission:
  action:
  - es:DescribeDomain
  - es:DescribeDomains
  resource_type: AWS::OpenSearchService::Domain
emit:
  target_type: '*'
  source_type: Identity
  source: <principal>
  target: <domain (SearchService)>
  permissions:
  - es:DescribeDomain
  narrative: "{principal.name} can read the configuration and endpoint of OpenSearch domain {domain.name}\
    \ (es:DescribeDomain) \u2014 recon for the endpoint URL, VPC/FGAC settings, and access policy."