rage.fail

aws-ssm-params-securestring-node

explicit aws emits ContainsSecret

match (record)

{ "field": "Type", "resource_type": "AWS::SSM::Parameter" }

where

Type == SecureString

emit

target type	`Secret`
source	`<parameter node (Storage/Data view)>`
target	`<Secret node for this SecureString>`

Narrative

{param.name} is a SecureString parameter storing encrypted secret material.

Raw rule rules/explicit/aws-ssm-params.yaml

id: aws-ssm-params-securestring-node
emits: ContainsSecret
applies_to:
- aws
match_record:
  resource_type: AWS::SSM::Parameter
  field: Type
where:
- Type == SecureString
emit:
  target_type: Secret
  source: <parameter node (Storage/Data view)>
  target: <Secret node for this SecureString>
  api_source: ssm:DescribeParameters
  evidence_field: Type
  narrative: '{param.name} is a SecureString parameter storing encrypted secret material.'