rage.fail

aws-ssm-params-can-write

explicit aws emits CanWrite

match (effective permission)

{ "action": "ssm:PutParameter", "resource_type": "AWS::SSM::Parameter" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<parameter node>`
permissions	`ssm:PutParameter`

Narrative

{principal.name} can overwrite parameter {param.name} (ssm:PutParameter, Overwrite).

Raw rule rules/explicit/aws-ssm-params.yaml

id: aws-ssm-params-can-write
emits: CanWrite
applies_to:
- aws
match_effective_permission:
  action: ssm:PutParameter
  resource_type: AWS::SSM::Parameter
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <parameter node>
  api_source: iam:SimulatePrincipalPolicy | policy evaluation
  permissions:
  - ssm:PutParameter
  narrative: '{principal.name} can overwrite parameter {param.name} (ssm:PutParameter, Overwrite).'