rage.fail

aws-sso-permset-has-managed-policy

explicit aws emits HasPolicy

match (record)

{ "field": "ManagedPolicies", "resource_type": "AWS::SSO::PermissionSet" }

emit

source type	`Role`
target type	`Policy`
source	`<PermissionSet node (Role)>`
target	`<IAMPolicy node for each AttachedManagedPolicies[].Arn>`

Narrative

Permission set {permset.name} has managed policy {policy.name} attached; every assigned principal receives these permissions in each assigned account.

Raw rule rules/explicit/aws-sso.yaml

id: aws-sso-permset-has-managed-policy
emits: HasPolicy
applies_to:
- aws
match_record:
  resource_type: AWS::SSO::PermissionSet
  field: ManagedPolicies
emit:
  source_type: Role
  target_type: Policy
  source: <PermissionSet node (Role)>
  target: <IAMPolicy node for each AttachedManagedPolicies[].Arn>
  api_source: sso-admin:ListManagedPoliciesInPermissionSet
  evidence_field: AttachedManagedPolicies[].Arn
  narrative: Permission set {permset.name} has managed policy {policy.name} attached; every assigned principal
    receives these permissions in each assigned account.