rage.fail

aws-sso-permset-has-inline-policy

explicit aws emits HasPolicy

match (record)

{ "field": "InlinePolicy", "resource_type": "AWS::SSO::PermissionSet" }

where

InlinePolicy is non-empty

emit

source type	`Role`
target type	`Policy`
source	`<PermissionSet node (Role)>`
target	`<IAMPolicy node (inline, keyed by PermissionSet ARN + 'inline')>`

Narrative

Permission set {permset.name} has an inline policy; the effective permissions for all assignees include this policy document.

Raw rule rules/explicit/aws-sso.yaml

id: aws-sso-permset-has-inline-policy
emits: HasPolicy
applies_to:
- aws
match_record:
  resource_type: AWS::SSO::PermissionSet
  field: InlinePolicy
where:
- InlinePolicy is non-empty
emit:
  source_type: Role
  target_type: Policy
  source: <PermissionSet node (Role)>
  target: <IAMPolicy node (inline, keyed by PermissionSet ARN + 'inline')>
  api_source: sso-admin:GetInlinePolicyForPermissionSet
  evidence_field: InlinePolicy (JSON document)
  narrative: Permission set {permset.name} has an inline policy; the effective permissions for all assignees
    include this policy document.