aws-ssm-params-securestring-key
explicit
aws
emits
match (record)
{
"field": "KeyId",
"resource_type": "AWS::SSM::Parameter"
}
where
Type == SecureString
emit
| target | <Secret node for this SecureString> |
|---|
Narrative
{param.name} is encrypted with KMS key {value} (decrypt gates read; consumed by the derived key_permission lookup, not a graph edge).
Raw rule rules/explicit/aws-ssm-params.yaml
id: aws-ssm-params-securestring-key
sets_node_property: kms_key
applies_to:
- aws
match_record:
resource_type: AWS::SSM::Parameter
field: KeyId
where:
- Type == SecureString
emit:
target: <Secret node for this SecureString>
property: kms_key
value: <EncryptionKey node id/ARN for KeyId (defaults to alias/aws/ssm when absent)>
api_source: ssm:DescribeParameters
evidence_field: KeyId
narrative: '{param.name} is encrypted with KMS key {value} (decrypt gates read; consumed by the derived
key_permission lookup, not a graph edge).'