rage.fail

aws-ssm-params-can-read-secret-by-path

explicit aws emits CanReadSecret

match (effective permission)

{ "action": "ssm:GetParametersByPath", "resource_type": "AWS::SSM::Parameter" }

where

the granted resource prefix is an ancestor of a SecureString parameter's name

emit

source	`<principal>`
target	`<Secret node for each in-scope descendant SecureString>`
permissions	`ssm:GetParametersByPath`

Narrative

{principal.name} can recursively read SecureStrings under a path (ssm:GetParametersByPath), including {param.name}.

Raw rule rules/explicit/aws-ssm-params.yaml

id: aws-ssm-params-can-read-secret-by-path
emits: CanReadSecret
applies_to:
- aws
match_effective_permission:
  action: ssm:GetParametersByPath
  resource_type: AWS::SSM::Parameter
where:
- the granted resource prefix is an ancestor of a SecureString parameter's name
emit:
  source: <principal>
  target: <Secret node for each in-scope descendant SecureString>
  api_source: iam:SimulatePrincipalPolicy | policy evaluation
  permissions:
  - ssm:GetParametersByPath
  narrative: '{principal.name} can recursively read SecureStrings under a path (ssm:GetParametersByPath),
    including {param.name}.'