aws-redshift-serverless-putresourcepolicy-cross-account

redshift-serverless:PutResourcePolicy allows a principal to grant another AWS account live access to a Redshift Serverless namespace via resource policy.

derived aws emits CrossAccountTrust

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Data`
target type	`Account`
source	`?namespace`
target	`<external AWS account in the resource policy>`
permissions	`redshift-serverless:PutResourcePolicy`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when redshift-serverless:PutResourcePolicy is confirmed EFFECTIVE on the namespace ARN and no SCP denial exists. CONDITIONAL(scp_or_org_policy) when an SCP may restrict namespace policy mutation. BLOCKED by explicit SCP deny on PutResourcePolicy. The consumer account must separately call AssociateDataShareConsumer to bind the policy grant to a live connection.

source type

Data

target type

Account

source

?namespace

target

<external AWS account in the resource policy>

permissions

redshift-serverless:PutResourcePolicy

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE when redshift-serverless:PutResourcePolicy is confirmed EFFECTIVE on the namespace ARN and no SCP denial exists. CONDITIONAL(scp_or_org_policy) when an SCP may restrict namespace policy mutation. BLOCKED by explicit SCP deny on PutResourcePolicy. The consumer account must separately call AssociateDataShareConsumer to bind the policy grant to a live connection.

Narrative

{principal.name} can update the resource policy on Redshift Serverless namespace {namespace.name} (redshift-serverless:PutResourcePolicy), granting an external AWS account live access to the namespace's tables - cross-account data sharing without snapshot export.

Raw rule rules/derived/aws/redshift.yaml

id: aws-redshift-serverless-putresourcepolicy-cross-account
emits: CrossAccountTrust
description: redshift-serverless:PutResourcePolicy allows a principal to grant another AWS account live
  access to a Redshift Serverless namespace via resource policy.
match:
- - principal: null
  - HasPermission
  - namespace: null
where:
- node_type(?namespace) == DataWarehouse
- ?namespace.provider_type == 'AWS::RedshiftServerless::Namespace'
- ?principal has EFFECTIVE redshift-serverless:PutResourcePolicy on ?namespace ARN
emit:
  source_type: Data
  target_type: Account
  source: ?namespace
  target: <external AWS account in the resource policy>
  permissions:
  - redshift-serverless:PutResourcePolicy
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when redshift-serverless:PutResourcePolicy is confirmed EFFECTIVE on the namespace
    ARN and no SCP denial exists. CONDITIONAL(scp_or_org_policy) when an SCP may restrict namespace policy
    mutation. BLOCKED by explicit SCP deny on PutResourcePolicy. The consumer account must separately
    call AssociateDataShareConsumer to bind the policy grant to a live connection.
  confidence: min(contributing_confidences) * 0.90
  derived_from:
  - ?principal HasPermission ?namespace (redshift-serverless:PutResourcePolicy effective permission)
  false_positive_note: PutResourcePolicy sets the namespace's resource policy; the cross-account grant
    is scoped by the principals named in the policy document. A public policy (Effect:Allow Principal:*)
    grants all AWS accounts; a specific AWS account ID scopes the grant. The consumer must call AssociateDataShareConsumer
    and have a cluster/workgroup to query through. Emit CrossAccountTrust for the capability; do not emit
    CanReadData directly (that is the consumer's derived edge).
  narrative: "{principal.name} can update the resource policy on Redshift Serverless namespace {namespace.name}\
    \ (redshift-serverless:PutResourcePolicy), granting an external AWS account live access to the namespace's\
    \ tables \u2014 cross-account data sharing without snapshot export."