rage.fail

aws-redshift-serverless-snapshot-cross-account-access

explicit aws emits CrossAccountTrust

match (record)

{ "field": "AccountsWithRestoreAccess[].AccountId", "resource_type": "AWS::RedshiftServerless::Snapshot" }

where

AccountsWithRestoreAccess[].AccountId is non-empty

emit

source type	`Snapshot`
target type	`Account`
source	`<Redshift Serverless Snapshot>`
target	`<AWS Account at AccountsWithRestoreAccess[].AccountId>`

Narrative

Redshift Serverless snapshot {snapshot.name} grants restore access to account {account.id} (AccountsWithRestoreAccess). That account can restore the snapshot as a new Serverless namespace, gaining complete access to the snapshot's data.

Raw rule rules/explicit/aws-redshift.yaml

id: aws-redshift-serverless-snapshot-cross-account-access
emits: CrossAccountTrust
match_record:
  resource_type: AWS::RedshiftServerless::Snapshot
  field: AccountsWithRestoreAccess[].AccountId
where:
- AccountsWithRestoreAccess[].AccountId is non-empty
emit:
  source_type: Snapshot
  target_type: Account
  source: <Redshift Serverless Snapshot>
  target: <AWS Account at AccountsWithRestoreAccess[].AccountId>
  api_source: redshift-serverless:GetSnapshot
  evidence_field: AccountsWithRestoreAccess[].AccountId
  state: ACTIVE
  narrative: Redshift Serverless snapshot {snapshot.name} grants restore access to account {account.id}
    (AccountsWithRestoreAccess). That account can restore the snapshot as a new Serverless namespace,
    gaining complete access to the snapshot's data.