aws-ram-org-wide-share-exposed-to-tenant

A RAM share whose principal is the organization root (o-*) exposes the shared resource to every current and future member account in the organization - ExposedToTenant.

derived aws emits ExposedToTenant

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'share': None} CrossAccountTrust {'org': None}

where

node_type(?share) == ResourcePolicy # RAM ResourceShare node_type(?org) == Organization # principals[] contains o-<org-id> ?share.status == 'ACTIVE' ram:EnableSharingWithAwsOrganization has been called (org-wide sharing is enabled)

emit

source type	`ResourcePolicy`
target type	`Organization`
source	`<shared resource node referenced in ?share.resourceArns>`
target	`?org`
conditions	`service_state`
state logic	ACTIVE when ram:EnableSharingWithAwsOrganization is confirmed to be enabled in the org and the share status is ACTIVE (no invitation required for org-internal sharing). CONDITIONAL(service_state) when EnableSharingWithAwsOrganization status is unknown or the share is PENDING. BLOCKED if an SCP denies ram:CreateResourceShare with org-wide principals. This edge carries HIGH blast radius: it covers ALL current + future org members. Inherit weakest from the CrossAccountTrust contributor.

Narrative

RAM share {share.name} in account {owner_account.name} grants access to {resource.name} to the ENTIRE Organization {org.name} (org-wide principal o-{org.id}). Every current and future member account can access this resource without any invitation - ExposedToTenant (high blast radius).

Raw rule rules/derived/aws/ram.yaml

id: aws-ram-org-wide-share-exposed-to-tenant
emits: ExposedToTenant
description: "A RAM share whose principal is the organization root (o-*) exposes the shared resource to\
  \ every current and future member account in the organization \u2014 ExposedToTenant."
match:
- - share: null
  - CrossAccountTrust
  - org: null
where:
- 'node_type(?share) == ResourcePolicy   # RAM ResourceShare'
- 'node_type(?org) == Organization   # principals[] contains o-<org-id>'
- ?share.status == 'ACTIVE'
- ram:EnableSharingWithAwsOrganization has been called (org-wide sharing is enabled)
emit:
  source_type: ResourcePolicy
  target_type: Organization
  source: <shared resource node referenced in ?share.resourceArns>
  target: ?org
  permissions: []
  conditions:
  - service_state
  state_logic: 'ACTIVE when ram:EnableSharingWithAwsOrganization is confirmed to be enabled in the org
    and the share status is ACTIVE (no invitation required for org-internal sharing). CONDITIONAL(service_state)
    when EnableSharingWithAwsOrganization status is unknown or the share is PENDING. BLOCKED if an SCP
    denies ram:CreateResourceShare with org-wide principals. This edge carries HIGH blast radius: it covers
    ALL current + future org members. Inherit weakest from the CrossAccountTrust contributor.'
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - <CrossAccountTrust edge_id (share -> Organization)>
  - <ram:EnableSharingWithAwsOrganization confirmed>
  false_positive_note: "ONLY for org-root (o-*) principals \u2014 OU-level (ou-*) shares reach only that\
    \ OU's member accounts, not the whole org. Do NOT emit ExposedToTenant for OU-level shares; emit individual\
    \ CrossAccountTrust edges (or a set-note for analysts). Org-wide sharing requires ram:EnableSharingWithAwsOrganization\
    \ to have been called in the management account \u2014 if that is not confirmed, downgrade to CONDITIONAL(service_state).\
    \ The consumer still needs to call ec2:CreateTransitGatewayVpcAttachment / launch instances in the\
    \ subnet / etc. to REALIZE the access; ExposedToTenant reflects that EVERY member account has the\
    \ right to do so, not that they have already. Do NOT conflate ExposedToTenant with the management-account\
    \ having control of member accounts \u2014 RAM sharing grants resource access, not account control."
  narrative: "RAM share {share.name} in account {owner_account.name} grants access to {resource.name}\
    \ to the ENTIRE Organization {org.name} (org-wide principal o-{org.id}). Every current and future\
    \ member account can access this resource without any invitation \u2014 ExposedToTenant (high blast\
    \ radius)."