aws-opensearch-cross-account-read-data

id: aws-opensearch-cross-account-read-data
emits: CanReadData
description: A foreign-account principal allowed by the domain access policy reads OpenSearch data cross-account.
match:
- - resource_policy: null
  - CrossAccountTrust
  - foreign_account: null
- - domain: null
  - HasPolicy
  - resource_policy: null
where:
- node_type(?domain) == SearchService
- the CrossAccountTrust grant includes es:ESHttpGet or es:ESHttpHead
- ?foreign_principal is the principal named in the cross-account Allow
emit:
  source_type: Identity
  target_type: SearchService
  source: <foreign principal (ExternalIdentity or Identity in foreign account)>
  target: ?domain
  permissions:
  - es:ESHttpGet
  - es:ESHttpHead
  conditions:
  - resource_policy
  - network_reachability
  state_logic: 'Inherit from the CrossAccountTrust edge: ACTIVE when CrossAccountTrust is ACTIVE and network
    reach from the foreign account to the domain endpoint is satisfied (trivially true for public endpoints;
    CONDITIONAL(network_reachability) for VPC endpoints where private link / peering to the foreign account
    is required). CONDITIONAL when the CrossAccountTrust is CONDITIONAL.'
  false_positive_note: The foreign principal must also have permission in its OWN account to call es:ESHttpGet
    (absence of an IAM deny in the caller's identity policies). For public-endpoint domains this is straightforward;
    for VPC domains the foreign account must have network reachability (VPC peering, PrivateLink) to the
    OpenSearch VPC endpoint. Do not emit ACTIVE for VPC domains without network reachability evidence.
  narrative: "{foreign_principal.name} (account {foreign_account}) can read indexed data from OpenSearch\
    \ domain {domain.name} directly via cross-account domain access policy grant \u2014 no cross-account\
    \ role assumption required, only signed HTTP requests to the domain endpoint."