rage.fail

aws-securityhub-effective-read

explicit aws emits CanRead

match (effective permission)

{ "actions": [ "securityhub:GetFindings" ], "resource_type": "AWS::SecurityHub::Hub" }

emit

source type	`Identity`
target type	`SecurityService`
source	`<principal>`
target	`<Security Hub node in account+region>`
permissions	`securityhub:GetFindings`

Narrative

{principal.name} can read Security Hub findings in {account}/{region} (securityhub:GetFindings).

Raw rule rules/explicit/aws/securityhub.yaml

id: aws-securityhub-effective-read
emits: CanRead
applies_to:
- aws
match_effective_permission:
  actions:
  - securityhub:GetFindings
  resource_type: AWS::SecurityHub::Hub
emit:
  source_type: Identity
  target_type: SecurityService
  source: <principal>
  target: <Security Hub node in account+region>
  permissions:
  - securityhub:GetFindings
  narrative: '{principal.name} can read Security Hub findings in {account}/{region} (securityhub:GetFindings).'