rage.fail

aws-ram-update-resource-share

explicit aws emits CanModifyPolicy

match (effective permission)

{ "action": "ram:UpdateResourceShare", "resource_type": "AWS::RAM::ResourceShare" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<ResourceShare node in scope>`
permissions	`ram:UpdateResourceShare`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when effective ram:UpdateResourceShare on the share ARN. CONDITIONAL(iam_permission) when tag-conditioned. BLOCKED when SCP denies.

Narrative

{principal.name} can update RAM share {share.name} (ram:UpdateResourceShare), including flipping allowExternalPrincipals to enable cross-org sharing.

Raw rule rules/explicit/aws-ram.yaml

id: aws-ram-update-resource-share
emits: CanModifyPolicy
applies_to:
- aws
match_effective_permission:
  action: ram:UpdateResourceShare
  resource_type: AWS::RAM::ResourceShare
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <ResourceShare node in scope>
  api_source: iam:SimulatePrincipalPolicy | policy evaluation
  permissions:
  - ram:UpdateResourceShare
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when effective ram:UpdateResourceShare on the share ARN. CONDITIONAL(iam_permission)
    when tag-conditioned. BLOCKED when SCP denies.
  false_positive_note: "ram:UpdateResourceShare can flip allowExternalPrincipals from false to true, enabling\
    \ the addition of external account principals. If that flag was previously blocking an external-account\
    \ association, flipping it is a guardrail removal \u2014 consumed by hierarchy-chains rule 3's CanModifyPolicy\
    \ branch. Only the share owner can call this. Consumer cannot update a share they don't own."
  narrative: '{principal.name} can update RAM share {share.name} (ram:UpdateResourceShare), including
    flipping allowExternalPrincipals to enable cross-org sharing.'