rage.fail

aws-redshift-snapshot-cross-account-access

explicit aws emits CrossAccountTrust

match (record)

{ "field": "AccountsWithRestoreAccess[].AccountId", "resource_type": "AWS::Redshift::ClusterSnapshot" }

where

AccountsWithRestoreAccess[].AccountId is non-empty

emit

source type	`Snapshot`
target type	`Account`
source	`<Redshift Cluster Snapshot>`
target	`<AWS Account at AccountsWithRestoreAccess[].AccountId>`

Narrative

Redshift snapshot {snapshot.name} grants restore access to account {account.id} (AccountsWithRestoreAccess). That account can call RestoreFromClusterSnapshot to spin up a full cluster copy, gaining complete access to the snapshot's data.

Raw rule rules/explicit/aws-redshift.yaml

id: aws-redshift-snapshot-cross-account-access
emits: CrossAccountTrust
match_record:
  resource_type: AWS::Redshift::ClusterSnapshot
  field: AccountsWithRestoreAccess[].AccountId
where:
- AccountsWithRestoreAccess[].AccountId is non-empty
emit:
  source_type: Snapshot
  target_type: Account
  source: <Redshift Cluster Snapshot>
  target: <AWS Account at AccountsWithRestoreAccess[].AccountId>
  api_source: redshift:DescribeClusterSnapshots
  evidence_field: AccountsWithRestoreAccess[].AccountId
  state: ACTIVE
  narrative: Redshift snapshot {snapshot.name} grants restore access to account {account.id} (AccountsWithRestoreAccess).
    That account can call RestoreFromClusterSnapshot to spin up a full cluster copy, gaining complete
    access to the snapshot's data.