rage.fail

aws-redshift-executes-as-cluster-role

explicit aws emits ExecutesAs

match (record)

{ "field": "ClusterIamRoles[].IamRoleArn", "resource_type": "AWS::Redshift::Cluster" }

where

ClusterIamRoles[].IamRoleArn is non-empty

emit

source type	`Data`
target type	`MachineIdentity`
source	`<Redshift Cluster (DataWarehouse node)>`
target	`<IAM Role at ClusterIamRoles[].IamRoleArn>`

Narrative

{cluster.name} executes as {role.name}. This role is used by the cluster engine for COPY, UNLOAD, CREATE EXTERNAL SCHEMA (Spectrum/Glue), and CREATE EXTERNAL FUNCTION (Lambda UDF) calls. Any SQL that references this role exercises its AWS permissions.

Raw rule rules/explicit/aws-redshift.yaml

id: aws-redshift-executes-as-cluster-role
emits: ExecutesAs
match_record:
  resource_type: AWS::Redshift::Cluster
  field: ClusterIamRoles[].IamRoleArn
where:
- ClusterIamRoles[].IamRoleArn is non-empty
emit:
  source_type: Data
  target_type: MachineIdentity
  source: <Redshift Cluster (DataWarehouse node)>
  target: <IAM Role at ClusterIamRoles[].IamRoleArn>
  api_source: redshift:DescribeClusters
  evidence_field: ClusterIamRoles[].IamRoleArn
  state: ACTIVE
  narrative: '{cluster.name} executes as {role.name}. This role is used by the cluster engine for COPY,
    UNLOAD, CREATE EXTERNAL SCHEMA (Spectrum/Glue), and CREATE EXTERNAL FUNCTION (Lambda UDF) calls. Any
    SQL that references this role exercises its AWS permissions.'