rage.fail

aws-redshift-serverless-namespace-resource-policy

explicit aws emits CrossAccountTrust

match (record)

{ "field": "resourcePolicy", "resource_type": "AWS::RedshiftServerless::Namespace" }

where

resourcePolicy contains Principal with AWS account ID != namespace's own account

emit

source type	`Data`
target type	`Account`
source	`<Redshift Serverless Namespace (DataWarehouse)>`
target	`<AWS Account ID in the resource policy Principal>`

Narrative

{namespace.name} has a resource policy that grants cross-account access to account {account.id}. That account can call AssociateDataShareConsumer to read live namespace data without a snapshot export.

Raw rule rules/explicit/aws-redshift.yaml

id: aws-redshift-serverless-namespace-resource-policy
emits: CrossAccountTrust
match_record:
  resource_type: AWS::RedshiftServerless::Namespace
  field: resourcePolicy
where:
- resourcePolicy contains Principal with AWS account ID != namespace's own account
emit:
  source_type: Data
  target_type: Account
  source: <Redshift Serverless Namespace (DataWarehouse)>
  target: <AWS Account ID in the resource policy Principal>
  api_source: redshift-serverless:GetResourcePolicy
  evidence_field: resourcePolicy
  state: ACTIVE
  narrative: '{namespace.name} has a resource policy that grants cross-account access to account {account.id}.
    That account can call AssociateDataShareConsumer to read live namespace data without a snapshot export.'