rage.fail

aws-redshift-serverless-admin-password-secret

explicit aws emits ContainsSecret

match (record)

{ "field": "adminPasswordSecretArn", "resource_type": "AWS::RedshiftServerless::Namespace" }

where

adminPasswordSecretArn is non-empty

emit

source type	`Data`
target type	`Secret`
source	`<Redshift Serverless Namespace (DataWarehouse node)>`
target	`<Secrets Manager secret at adminPasswordSecretArn>`

Narrative

{namespace.name} (Redshift Serverless) stores its admin database password in Secrets Manager secret {secret.name}. Retrieval grants DB superuser access.

Raw rule rules/explicit/aws-redshift.yaml

id: aws-redshift-serverless-admin-password-secret
emits: ContainsSecret
match_record:
  resource_type: AWS::RedshiftServerless::Namespace
  field: adminPasswordSecretArn
where:
- adminPasswordSecretArn is non-empty
emit:
  source_type: Data
  target_type: Secret
  source: <Redshift Serverless Namespace (DataWarehouse node)>
  target: <Secrets Manager secret at adminPasswordSecretArn>
  api_source: redshift-serverless:GetNamespace
  evidence_field: adminPasswordSecretArn
  state: ACTIVE
  narrative: '{namespace.name} (Redshift Serverless) stores its admin database password in Secrets Manager
    secret {secret.name}. Retrieval grants DB superuser access.'