rage.fail

aws-ram-create-resource-share

explicit aws emits CanCreate

match (effective permission)

{ "action": "ram:CreateResourceShare", "resource_type": "AWS::RAM::ResourceShare" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<owner Account (scope of the create action)>`
permissions	`ram:CreateResourceShare`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when effective ram:CreateResourceShare in the account. BLOCKED when SCP denies.

Narrative

{principal.name} can create new RAM resource shares (ram:CreateResourceShare) in account {account.name}, manufacturing new cross-account access grants to any owned resource.

Raw rule rules/explicit/aws-ram.yaml

id: aws-ram-create-resource-share
emits: CanCreate
applies_to:
- aws
match_effective_permission:
  action: ram:CreateResourceShare
  resource_type: AWS::RAM::ResourceShare
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <owner Account (scope of the create action)>
  api_source: iam:SimulatePrincipalPolicy | policy evaluation
  permissions:
  - ram:CreateResourceShare
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when effective ram:CreateResourceShare in the account. BLOCKED when SCP denies.
  false_positive_note: CanCreate here surfaces the principal's ability to manufacture NEW CrossAccountTrust
    edges ex nihilo. The actual cross-account trust only materializes once the share is created and (for
    non-org shares) accepted. The downstream POTENTIAL CrossAccountTrust and capability edges are derived
    from the OBSERVED share; this edge surfaces the creation right for analyst awareness.
  narrative: '{principal.name} can create new RAM resource shares (ram:CreateResourceShare) in account
    {account.name}, manufacturing new cross-account access grants to any owned resource.'