rage.fail

aws-rolesanywhere-cert-valid-for-role

explicit aws emits CredentialValidFor

match (record)

{ "field": "subjects", "resource_type": "AWS::RolesAnywhere::TrustAnchor" }

where

a specific end-entity certificate (Certificate/Secret) chains to the anchor CA its subject/SAN satisfies the target role's trust condition (or the role trust has no cert condition)

emit

source type	`Certificate`
target type	`Identity`
source	`<end-entity client certificate (Certificate / Secret)>`
target	`<IAM role the cert authenticates as (Identity)>`

Narrative

Certificate {cert.subject} (chaining to {anchor.ca}) authenticates as IAM role {role.name} via IAM Roles Anywhere; its private-key holder holds {role.name}'s temporary credentials.

Raw rule rules/explicit/aws-rolesanywhere.yaml

id: aws-rolesanywhere-cert-valid-for-role
emits: CredentialValidFor
applies_to:
- aws
match_record:
  resource_type: AWS::RolesAnywhere::TrustAnchor
  field: subjects
where:
- a specific end-entity certificate (Certificate/Secret) chains to the anchor CA
- its subject/SAN satisfies the target role's trust condition (or the role trust has no cert condition)
emit:
  source_type: Certificate
  target_type: Identity
  source: <end-entity client certificate (Certificate / Secret)>
  target: <IAM role the cert authenticates as (Identity)>
  api_source: rolesanywhere:ListSubjects | CloudTrail CreateSession | issued-cert record
  evidence_field: certificate Subject/SAN/serial ; role trust condition
  note: "The private key + certificate together are the credential \u2014 a holder of the private key\
    \ (e.g. via Phase-5 aws:acm/aws:acmpca export, or a leaked key on a compromised host) authenticates\
    \ as the role. IAM Roles Anywhere never stores the private key."
  narrative: Certificate {cert.subject} (chaining to {anchor.ca}) authenticates as IAM role {role.name}
    via IAM Roles Anywhere; its private-key holder holds {role.name}'s temporary credentials.