rage.fail

aws-redshift-serverless-executes-as-namespace-role

explicit aws emits ExecutesAs

match (record)

{ "field": "iamRoles[]", "resource_type": "AWS::RedshiftServerless::Namespace" }

where

iamRoles[] is non-empty

emit

source type	`Data`
target type	`MachineIdentity`
source	`<Redshift Serverless Namespace (DataWarehouse node)>`
target	`<IAM Role at iamRoles[]>`

Narrative

{namespace.name} (Redshift Serverless namespace) executes as {role.name}. This role is used by COPY, UNLOAD, and external function calls within the namespace.

Raw rule rules/explicit/aws-redshift.yaml

id: aws-redshift-serverless-executes-as-namespace-role
emits: ExecutesAs
match_record:
  resource_type: AWS::RedshiftServerless::Namespace
  field: iamRoles[]
where:
- iamRoles[] is non-empty
emit:
  source_type: Data
  target_type: MachineIdentity
  source: <Redshift Serverless Namespace (DataWarehouse node)>
  target: <IAM Role at iamRoles[]>
  api_source: redshift-serverless:GetNamespace
  evidence_field: iamRoles[]
  state: ACTIVE
  narrative: '{namespace.name} (Redshift Serverless namespace) executes as {role.name}. This role is used
    by COPY, UNLOAD, and external function calls within the namespace.'