aws-ram-share-crossaccount-trust

id: aws-ram-share-crossaccount-trust
emits: CrossAccountTrust
applies_to:
- aws
match_record:
  resource_type: AWS::RAM::ResourceShare
  field: principals
where:
- principal_entry matches a 12-digit AWS account ID
- 'account_id(principal_entry) != share.owningAccountId   # cross-account, not self'
- share.allowExternalPrincipals == true OR same_org(principal_entry, share.owningAccountId)
emit:
  source_type: ResourcePolicy
  target_type: Account
  source: <ResourceShare node (ResourcePolicy)>
  target: <Account node for principal_entry account ID>
  api_source: ram:GetResourceShares + ram:ListPrincipals (associationType=PRINCIPAL)
  evidence_field: ResourceShare.principals[]
  permissions: []
  conditions:
  - resource_policy
  - service_state
  state_logic: ACTIVE when share.status == 'ACTIVE' (accepted or org-wide auto-accept). CONDITIONAL(service_state)
    when share.status == 'PENDING_ACCEPTANCE' (cross-account invitation not yet accepted by the consumer).
    BLOCKED if an SCP on the consumer account denies ram:AcceptResourceShareInvitation.
  false_positive_note: "A pending share grants NO access until accepted. Emit CONDITIONAL not ACTIVE for\
    \ PENDING_ACCEPTANCE status. Skip shares where principal_entry == owningAccountId (self-share, no\
    \ cross-account effect). When allowExternalPrincipals == false and the account is outside the org,\
    \ RAM rejects the association \u2014 the data should not appear, but if it does (stale/inconsistent\
    \ data), emit CONDITIONAL and flag as inconsistent."
  narrative: 'RAM share {share.name} (account {owner.name}) grants cross-account access to account {consumer.name}.
    Shared resources: {share.resourceArns}. Status: {share.status}.'