aws-redshift-authorize-datashare

redshift:AuthorizeDataShare grants a consumer AWS account real-time read access to producer cluster objects, establishing cross-account live data trust.

derived aws emits CrossAccountTrust

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'cluster': None}

where

node_type(?cluster) == DataWarehouse ?cluster.provider_type in ['AWS::Redshift::Cluster', 'AWS::RedshiftServerless::Namespace'] ?principal has EFFECTIVE redshift:AuthorizeDataShare on ?cluster ARN (or datashare ARN)

emit

source type	`Data`
target type	`Account`
source	`?cluster`
target	`<external AWS account named as consumer>`
permissions	`redshift:AuthorizeDataShare`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when redshift:AuthorizeDataShare is confirmed EFFECTIVE on the cluster/datashare ARN and no SCP denial exists. CONDITIONAL(scp_or_org_policy) when an SCP may restrict cross-account data sharing but hasn't been resolved. BLOCKED by an explicit SCP deny on redshift:AuthorizeDataShare or a Redshift cluster-level data-sharing configuration that blocks cross-account authorization. The consumer account must also call AssociateDataShareConsumer — that is a gate on the consumer side, not the producer capability being emitted here. The trust is from producer to consumer, not bidirectional.

Narrative

{cluster.name} grants a datashare authorization that allows external AWS account {account.id} to access Redshift data in real time (redshift:AuthorizeDataShare), enabling cross-account live table reads without data export.

Raw rule rules/derived/aws/redshift.yaml

id: aws-redshift-authorize-datashare
emits: CrossAccountTrust
description: redshift:AuthorizeDataShare grants a consumer AWS account real-time read access to producer
  cluster objects, establishing cross-account live data trust.
match:
- - principal: null
  - HasPermission
  - cluster: null
where:
- node_type(?cluster) == DataWarehouse
- ?cluster.provider_type in ['AWS::Redshift::Cluster', 'AWS::RedshiftServerless::Namespace']
- ?principal has EFFECTIVE redshift:AuthorizeDataShare on ?cluster ARN (or datashare ARN)
emit:
  source_type: Data
  target_type: Account
  source: ?cluster
  target: <external AWS account named as consumer>
  permissions:
  - redshift:AuthorizeDataShare
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: "ACTIVE when redshift:AuthorizeDataShare is confirmed EFFECTIVE on the cluster/datashare\
    \ ARN and no SCP denial exists. CONDITIONAL(scp_or_org_policy) when an SCP may restrict cross-account\
    \ data sharing but hasn't been resolved. BLOCKED by an explicit SCP deny on redshift:AuthorizeDataShare\
    \ or a Redshift cluster-level data-sharing configuration that blocks cross-account authorization.\
    \ The consumer account must also call AssociateDataShareConsumer \u2014 that is a gate on the consumer\
    \ side, not the producer capability being emitted here. The trust is from producer to consumer, not\
    \ bidirectional."
  confidence: min(contributing_confidences) * 0.90
  derived_from:
  - ?principal HasPermission ?cluster (redshift:AuthorizeDataShare effective permission)
  - ?cluster represents producer cluster (Data class)
  false_positive_note: "AuthorizeDataShare grants the AUTHORIZATION; the consumer must separately call\
    \ AssociateDataShareConsumer and have their own Redshift cluster or workgroup to query through. Do\
    \ NOT emit CanReadData here \u2014 that is the consumer's capability once the association is made,\
    \ not the producer's grant capability. The datashare object scope (which schemas/tables are shared)\
    \ limits what the consumer can read; an entire-cluster share is broader than a specific-schema share.\
    \ A datashare authorized to PUBLIC (all accounts) is effectively open cross-account trust; a datashare\
    \ authorized to a specific account ID is scoped. Model the difference in the edge's condition state."
  narrative: '{cluster.name} grants a datashare authorization that allows external AWS account {account.id}
    to access Redshift data in real time (redshift:AuthorizeDataShare), enabling cross-account live table
    reads without data export.'