rage.fail

aws-opensearch-resource-policy

explicit aws emits HasPolicy

match (record)

{ "field": "DomainStatus.AccessPolicies", "resource_type": "AWS::OpenSearchService::Domain" }

emit

source type	`*`
target type	`Policy`
source	`<domain (SearchService)>`
target	`<domain access policy (ResourcePolicy)>`

Narrative

{domain.name} has an access policy governing IAM-based access to its OpenSearch HTTP endpoint.

Raw rule rules/explicit/aws-opensearch.yaml

id: aws-opensearch-resource-policy
emits: HasPolicy
applies_to:
- aws
match_record:
  resource_type: AWS::OpenSearchService::Domain
  field: DomainStatus.AccessPolicies
emit:
  source_type: '*'
  target_type: Policy
  source: <domain (SearchService)>
  target: <domain access policy (ResourcePolicy)>
  api_source: es:DescribeDomain
  evidence_field: DomainStatus.AccessPolicies
  narrative: '{domain.name} has an access policy governing IAM-based access to its OpenSearch HTTP endpoint.'