aws-ram-accept-invitation

id: aws-ram-accept-invitation
emits: HasPermission
applies_to:
- aws
match_effective_permission:
  action: ram:AcceptResourceShareInvitation
  resource_type: AWS::RAM::ResourceShare
emit:
  source_type: Identity
  target_type: Account
  source: <consumer-account principal>
  target: '<owner Account (scope: consumer can accept invitations from any owner in this consumer account)>'
  api_source: iam:SimulatePrincipalPolicy | policy evaluation
  permissions:
  - ram:AcceptResourceShareInvitation
  conditions:
  - iam_permission
  - service_state
  state_logic: ACTIVE when the consumer principal has effective ram:AcceptResourceShareInvitation in the
    consumer account and there exists a PENDING_ACCEPTANCE share from an owner. CONDITIONAL(service_state)
    when the permission is present but no pending invitation exists yet. BLOCKED when SCP on the consumer
    account denies acceptance.
  false_positive_note: 'The invitation only exists when an owner has created a share with this consumer''s
    account ID as a principal and status == PENDING_ACCEPTANCE. This permission gates the upgrade from
    CONDITIONAL(service_state) CrossAccountTrust to ACTIVE. Scope: the principal''s account (not the specific
    share, since at evaluation time the share may not exist yet). If an SCP on the consumer denies this
    action, cross-account shares remain PENDING and BLOCKED regardless of the owner''s intent.'
  narrative: '{principal.name} in consumer account {consumer.name} can accept pending RAM invitations
    (ram:AcceptResourceShareInvitation), activating cross-account access to resources shared by other
    AWS accounts.'