rage.fail

aws-ram-share-locatedin-account

explicit aws emits LocatedIn

match (record)

{ "field": "owningAccountId", "resource_type": "AWS::RAM::ResourceShare" }

emit

source type	`*`
target type	`Account`
source	`<ResourceShare node (ResourcePolicy subtype)>`
target	`<Account node for owningAccountId>`

Narrative

RAM share {share.name} is owned by and located in account {account.name}.

Raw rule rules/explicit/aws-ram.yaml

id: aws-ram-share-locatedin-account
emits: LocatedIn
applies_to:
- aws
match_record:
  resource_type: AWS::RAM::ResourceShare
  field: owningAccountId
emit:
  target_type: Account
  source_type: '*'
  source: <ResourceShare node (ResourcePolicy subtype)>
  target: <Account node for owningAccountId>
  api_source: ram:GetResourceShares (resourceOwner=SELF)
  evidence_field: ResourceShare.owningAccountId
  narrative: RAM share {share.name} is owned by and located in account {account.name}.