rage.fail

aws-sso-permset-has-boundary

explicit aws emits HasPolicy

match (record)

{ "field": "PermissionsBoundary", "resource_type": "AWS::SSO::PermissionSet" }

where

PermissionsBoundary is present and non-empty

emit

source type	`Role`
target type	`PermissionBoundary`
source	`<PermissionSet node (Role)>`
target	`<PermissionBoundary node keyed by ManagedPolicyArn or CustomerManagedPolicyReference>`

Narrative

Permission set {permset.name} has a permissions boundary ({boundary.name}); effective permissions for all assignees are capped by this boundary.

Raw rule rules/explicit/aws-sso.yaml

id: aws-sso-permset-has-boundary
emits: HasPolicy
applies_to:
- aws
match_record:
  resource_type: AWS::SSO::PermissionSet
  field: PermissionsBoundary
where:
- PermissionsBoundary is present and non-empty
emit:
  source_type: Role
  target_type: PermissionBoundary
  source: <PermissionSet node (Role)>
  target: <PermissionBoundary node keyed by ManagedPolicyArn or CustomerManagedPolicyReference>
  api_source: sso-admin:GetPermissionsBoundaryForPermissionSet
  evidence_field: PermissionsBoundary.ManagedPolicyArn | PermissionsBoundary.CustomerManagedPolicyReference.Name
  narrative: Permission set {permset.name} has a permissions boundary ({boundary.name}); effective permissions
    for all assignees are capped by this boundary.