aws-ram-share-org-wide-exposed-to-tenant

id: aws-ram-share-org-wide-exposed-to-tenant
emits: ExposedToTenant
applies_to:
- aws
match_record:
  resource_type: AWS::RAM::ResourceShare
  field: principals
where:
- principal_entry matches regex '^arn:aws:organizations::.*:organization/o-'
- share.status == 'ACTIVE'
- ram:EnableSharingWithAwsOrganization has been called (or assumed true for ACTIVE shares)
emit:
  source_type: ResourcePolicy
  target_type: Organization
  source: <shared resource node(s) referenced in share.resourceArns>
  target: <Organization node matching the org ARN in principal_entry>
  api_source: ram:GetResourceShares + ram:ListPrincipals
  evidence_field: ResourceShare.principals[]
  permissions: []
  conditions:
  - resource_policy
  - service_state
  state_logic: 'ACTIVE when share.status == ''ACTIVE'' AND ram:EnableSharingWithAwsOrganization is confirmed
    enabled. CONDITIONAL(service_state) when enablement status is unconfirmed. This edge carries HIGH
    blast radius: it covers ALL current + future org members with the capability to use the shared resource.'
  false_positive_note: "Org-wide sharing requires ram:EnableSharingWithAwsOrganization to have been called\
    \ in the management account. If not confirmed, downgrade to CONDITIONAL(service_state). Member accounts\
    \ still need to take actions (attach TGW, launch instances in shared subnet, etc.) to REALIZE the\
    \ access; ExposedToTenant reflects that EVERY member account has the RIGHT to do so. Do NOT conflate\
    \ ExposedToTenant with the management-account controlling member accounts \u2014 RAM sharing grants\
    \ resource access, not account control. For OU-level shares (ou-* ARN), do NOT emit ExposedToTenant;\
    \ emit individual CrossAccountTrust edges to each member account (or a set-level note)."
  narrative: "RAM share {share.name} in account {owner.name} grants access to {resource.name} to the ENTIRE\
    \ Organization {org.name} (org-wide principal o-{org.id}). Every current and future member account\
    \ can access this resource without invitation \u2014 high blast-radius exposure."