rage.fail

aws-ram-associate-resource-share

explicit aws emits CanModifyPolicy

match (effective permission)

{ "action": "ram:AssociateResourceShare", "resource_type": "AWS::RAM::ResourceShare" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<ResourceShare node in scope>`
permissions	`ram:AssociateResourceShare`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when the principal has unconditional EFFECTIVE ram:AssociateResourceShare on the share ARN. CONDITIONAL(iam_permission) when scoped by a condition (e.g. aws:ResourceTag). BLOCKED when an SCP denies the action.

Narrative

{principal.name} can add principals to RAM share {share.name} (ram:AssociateResourceShare), granting cross-account access to the shared resources to any account ID it names.

Raw rule rules/explicit/aws-ram.yaml

id: aws-ram-associate-resource-share
emits: CanModifyPolicy
applies_to:
- aws
match_effective_permission:
  action: ram:AssociateResourceShare
  resource_type: AWS::RAM::ResourceShare
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <ResourceShare node in scope>
  api_source: iam:SimulatePrincipalPolicy | policy evaluation
  permissions:
  - ram:AssociateResourceShare
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when the principal has unconditional EFFECTIVE ram:AssociateResourceShare on the
    share ARN. CONDITIONAL(iam_permission) when scoped by a condition (e.g. aws:ResourceTag). BLOCKED
    when an SCP denies the action.
  false_positive_note: 'ONLY the OWNER account can call ram:AssociateResourceShare on a share. Consumer
    accounts cannot. Scope the permission check to the share ARN (wildcard Resource: "*" also triggers).
    This CanModifyPolicy is consumed by derived/aws/ram.yaml rule 4 (manufacture new CrossAccountTrust)
    and by hierarchy-chains.yaml guardrail-removal-upgrades-blocked when the share itself is the guardrail.'
  narrative: '{principal.name} can add principals to RAM share {share.name} (ram:AssociateResourceShare),
    granting cross-account access to the shared resources to any account ID it names.'