rage.fail

aws-secretsmanager-rotation-binding

explicit aws emits ContainsResourceReference

match (record)

{ "field": "RotationLambdaARN", "resource_type": "AWS::SecretsManager::Secret" }

where

RotationEnabled == true and RotationLambdaARN present

emit

target type	`*`
source	`<rotation Lambda function node (Compute)>`
target	`<secret node>`

Narrative

{function.name} is the rotation Lambda for {secret.name} (RotationLambdaARN).

Raw rule rules/explicit/aws-secretsmanager.yaml

id: aws-secretsmanager-rotation-binding
emits: ContainsResourceReference
applies_to:
- aws
match_record:
  resource_type: AWS::SecretsManager::Secret
  field: RotationLambdaARN
where:
- RotationEnabled == true and RotationLambdaARN present
emit:
  target_type: '*'
  source: <rotation Lambda function node (Compute)>
  target: <secret node>
  api_source: secretsmanager:DescribeSecret
  evidence_field: RotationLambdaARN
  record_property:
    node: <secret node>
    key: rotation_lambda_arn
    value: <RotationLambdaARN>
  narrative: '{function.name} is the rotation Lambda for {secret.name} (RotationLambdaARN).'
  note: 'Recon link consumed by the Lambda execute-as derivation: controlling the rotation function''s
    code yields its execution role, which holds GetSecretValue/PutSecretValue on this secret. The on-demand
    trigger (secretsmanager:RotateSecret) is modeled separately as the explicit CanInvoke edge below.
    Emitted Compute->Secret to honor the ContainsResourceReference source set.'