rage.fail

aws-sso-delete-permissions-boundary

explicit aws emits CanModifyPolicy

match (record)

{ "field": "PermissionsBoundary", "resource_type": "AWS::SSO::PermissionSet" }

where

PermissionsBoundary is present (exists) caller has sso-admin:DeletePermissionsBoundaryFromPermissionSet permission on this PermissionSet ARN

emit

source type	`Identity`
target type	`PermissionBoundary`
source	`<Principal with sso-admin:DeletePermissionsBoundaryFromPermissionSet on the PermissionSet>`
target	`<PermissionBoundary node>`

Narrative

{principal.name} has sso-admin:DeletePermissionsBoundaryFromPermissionSet on permission set {permset.name} and can remove the permissions boundary ({boundary.name}), uncapping the effective permissions of all principals assigned to that permission set.

Raw rule rules/explicit/aws-sso.yaml

id: aws-sso-delete-permissions-boundary
emits: CanModifyPolicy
applies_to:
- aws
match_record:
  resource_type: AWS::SSO::PermissionSet
  field: PermissionsBoundary
where:
- PermissionsBoundary is present (exists)
- caller has sso-admin:DeletePermissionsBoundaryFromPermissionSet permission on this PermissionSet ARN
emit:
  source_type: Identity
  target_type: PermissionBoundary
  source: <Principal with sso-admin:DeletePermissionsBoundaryFromPermissionSet on the PermissionSet>
  target: <PermissionBoundary node>
  api_source: sso-admin:ListPermissionSets + sso-admin:GetPermissionsBoundaryForPermissionSet + iam:ListPolicies
    for permission evaluation
  evidence_field: PermissionSet.PermissionsBoundary.ManagedPolicyArn | PermissionSet.PermissionsBoundary.CustomerManagedPolicyReference
  narrative: '{principal.name} has sso-admin:DeletePermissionsBoundaryFromPermissionSet on permission
    set {permset.name} and can remove the permissions boundary ({boundary.name}), uncapping the effective
    permissions of all principals assigned to that permission set.'