rage.fail

aws-redshift-serverless-workgroup-publicly-accessible

explicit aws emits ExposedToInternet

match (record)

{ "field": "publiclyAccessible", "resource_type": "AWS::RedshiftServerless::Workgroup" }

where

publiclyAccessible == true

emit

source type	`Data`
target type	`AnonymousIdentity`
source	`<Redshift Serverless Workgroup (DataWarehouse node)>`
target	`<AnonymousIdentity>`
conditions	`network_reachability`

Narrative

{workgroup.name} (Redshift Serverless) has publiclyAccessible=true. The workgroup endpoint is internet-routable. SG inbound port 5439 must also permit internet traffic; derived rule aws-redshift-public-cluster resolves this.

Raw rule rules/explicit/aws-redshift.yaml

id: aws-redshift-serverless-workgroup-publicly-accessible
emits: ExposedToInternet
match_record:
  resource_type: AWS::RedshiftServerless::Workgroup
  field: publiclyAccessible
where:
- publiclyAccessible == true
emit:
  source_type: Data
  target_type: AnonymousIdentity
  source: <Redshift Serverless Workgroup (DataWarehouse node)>
  target: <AnonymousIdentity>
  api_source: redshift-serverless:GetWorkgroup
  evidence_field: publiclyAccessible
  state: CONDITIONAL
  conditions:
  - network_reachability
  narrative: '{workgroup.name} (Redshift Serverless) has publiclyAccessible=true. The workgroup endpoint
    is internet-routable. SG inbound port 5439 must also permit internet traffic; derived rule aws-redshift-public-cluster
    resolves this.'