rage.fail

aws-sso-create-group-membership

explicit aws emits CanAddMember

match (record)

{ "field": "GroupId", "resource_type": "AWS::IdentityStore::Group" }

where

caller has identitystore:CreateGroupMembership permission on this group ARN

emit

source type	`Identity`
target type	`Group`
source	`<Principal with identitystore:CreateGroupMembership on the group>`
target	`<Identity Store Group node>`

Narrative

{principal.name} has identitystore:CreateGroupMembership on group {group.name} and can add any user to that group, causing the new member to inherit all account assignments the group holds.

Raw rule rules/explicit/aws-sso.yaml

id: aws-sso-create-group-membership
emits: CanAddMember
applies_to:
- aws
match_record:
  resource_type: AWS::IdentityStore::Group
  field: GroupId
where:
- caller has identitystore:CreateGroupMembership permission on this group ARN
emit:
  source_type: Identity
  target_type: Group
  source: <Principal with identitystore:CreateGroupMembership on the group>
  target: <Identity Store Group node>
  api_source: identitystore:ListGroups + iam:ListPolicies / GetUserPolicy / GetRolePolicy for permission
    evaluation
  evidence_field: Group.GroupId
  narrative: '{principal.name} has identitystore:CreateGroupMembership on group {group.name} and can add
    any user to that group, causing the new member to inherit all account assignments the group holds.'