rage.fail

aws-opensearch-cross-account-policy-trust

explicit aws emits CrossAccountTrust

match (record)

{ "field": "DomainStatus.AccessPolicies", "resource_type": "AWS::OpenSearchService::Domain" }

where

at least one Statement principal is in a different account than the domain Effect == Allow Action includes es:ESHttpGet, es:ESHttpPost, es:ESHttpPut, es:ESHttpDelete, or es:ESHttpHead (or es:* wildcard)

emit

source	`<domain access policy (ResourcePolicy)>`
target	`<foreign account principal (ExternalIdentity)>`

Narrative

The domain access policy for {domain.name} grants es:ESHttp* to {external.name} in account {foreign_account}, enabling cross-account data access without a role assumption hop.

Raw rule rules/explicit/aws-opensearch.yaml

id: aws-opensearch-cross-account-policy-trust
emits: CrossAccountTrust
applies_to:
- aws
match_record:
  resource_type: AWS::OpenSearchService::Domain
  field: DomainStatus.AccessPolicies
where:
- at least one Statement principal is in a different account than the domain
- Effect == Allow
- Action includes es:ESHttpGet, es:ESHttpPost, es:ESHttpPut, es:ESHttpDelete, or es:ESHttpHead (or es:*
  wildcard)
emit:
  source: <domain access policy (ResourcePolicy)>
  target: <foreign account principal (ExternalIdentity)>
  api_source: es:DescribeDomain
  evidence_field: DomainStatus.AccessPolicies
  narrative: The domain access policy for {domain.name} grants es:ESHttp* to {external.name} in account
    {foreign_account}, enabling cross-account data access without a role assumption hop.