rage.fail

aws-redshift-datashare-authorized-consumer

explicit aws emits CrossAccountTrust

match (record)

{ "field": "DataShareAssociations[].ConsumerIdentifier", "resource_type": "AWS::Redshift::DataShare" }

where

DataShareAssociations[].Status == 'AUTHORIZED' ConsumerIdentifier is a different AWS account ID

emit

source type	`Data`
target type	`Account`
source	`<Redshift Cluster / Datashare (DataWarehouse node)>`
target	`<Consumer AWS Account at ConsumerIdentifier>`

Narrative

{cluster.name} has authorized datashare access for account {account.id} (DataShareAssociations.Status=AUTHORIZED). The consumer account can query live Redshift tables in {cluster.name} in real time via their own cluster using the shared objects.

Raw rule rules/explicit/aws-redshift.yaml

id: aws-redshift-datashare-authorized-consumer
emits: CrossAccountTrust
match_record:
  resource_type: AWS::Redshift::DataShare
  field: DataShareAssociations[].ConsumerIdentifier
where:
- DataShareAssociations[].Status == 'AUTHORIZED'
- ConsumerIdentifier is a different AWS account ID
emit:
  source_type: Data
  target_type: Account
  source: <Redshift Cluster / Datashare (DataWarehouse node)>
  target: <Consumer AWS Account at ConsumerIdentifier>
  api_source: redshift:DescribeDataSharesForProducer
  evidence_field: DataShareAssociations[].ConsumerIdentifier
  state: ACTIVE
  narrative: '{cluster.name} has authorized datashare access for account {account.id} (DataShareAssociations.Status=AUTHORIZED).
    The consumer account can query live Redshift tables in {cluster.name} in real time via their own cluster
    using the shared objects.'