rage.fail

aws-rolesanywhere-external-maps-to-role

explicit aws emits ExternalIdentityMapsTo

match (record)

{ "field": "roleArns", "resource_type": "AWS::RolesAnywhere::Profile" }

where

?role in Profile.roleArns has a trust policy trusting rolesanywhere.amazonaws.com (backing TrustsExternalIdentity exists) the Profile is enabled and the referenced trust anchor is enabled

emit

source type	`FederatedIdentity`
target type	`Role`
source	`<cert-subject external identity (FederatedIdentity) admitted by the role trust condition>`
target	`<IAM role from Profile.roleArns>`

Narrative

A client certificate admitted by {role.name}'s trust condition maps, via profile {profile.name}, to IAM role {role.name} (its session capped by the profile session policy).

Raw rule rules/explicit/aws-rolesanywhere.yaml

id: aws-rolesanywhere-external-maps-to-role
emits: ExternalIdentityMapsTo
applies_to:
- aws
match_record:
  resource_type: AWS::RolesAnywhere::Profile
  field: roleArns
where:
- ?role in Profile.roleArns has a trust policy trusting rolesanywhere.amazonaws.com (backing TrustsExternalIdentity
  exists)
- the Profile is enabled and the referenced trust anchor is enabled
emit:
  source_type: FederatedIdentity
  target_type: Role
  source: <cert-subject external identity (FederatedIdentity) admitted by the role trust condition>
  target: <IAM role from Profile.roleArns>
  api_source: rolesanywhere:GetProfile + iam:GetRole
  evidence_field: Profile.roleArns / Profile.sessionPolicy / role AssumeRolePolicyDocument Condition
  condition_recorded:
    session_policy: Profile.sessionPolicy / managedPolicyArns (ceiling on the resulting session)
    cert_subject_pin: inherited from the role trust policy condition (the actual gate)
  narrative: A client certificate admitted by {role.name}'s trust condition maps, via profile {profile.name},
    to IAM role {role.name} (its session capped by the profile session policy).