rage.fail

aws-ssm-params-cross-account-share

explicit aws emits CrossAccountTrust

match (record)

{ "field": "ResourcePolicy", "resource_type": "AWS::SSM::Parameter" }

where

Tier == Advanced a RAM resource share or resource policy names a principal/account/OU outside the owning account

emit

source	`<parameter resource policy / RAM share>`
target	`<consumer account / OU / external principal>`

Narrative

{param.name} is shared (read-only) with account {account} via AWS RAM.

Raw rule rules/explicit/aws-ssm-params.yaml

id: aws-ssm-params-cross-account-share
emits: CrossAccountTrust
applies_to:
- aws
match_record:
  resource_type: AWS::SSM::Parameter
  field: ResourcePolicy
where:
- Tier == Advanced
- a RAM resource share or resource policy names a principal/account/OU outside the owning account
emit:
  source: <parameter resource policy / RAM share>
  target: <consumer account / OU / external principal>
  api_source: ssm:GetResourcePolicies | ram:ListResources
  evidence_field: ResourcePolicy / RAM resourceShareArn
  narrative: '{param.name} is shared (read-only) with account {account} via AWS RAM.'