rage.fail

aws-sso-provisioned-role-trusts-sso-oidc

explicit aws emits TrustsExternalIdentity

match (record)

{ "field": "AssumeRolePolicyDocument", "resource_type": "AWS::IAM::Role" }

where

role name starts_with 'AWSReservedSSO_' trust policy Principal Federated includes 'signin.aws.amazon.com' OR matches 'oidc.sso.*.amazonaws.com'

emit

source type	`Role`
target type	`FederatedIdentity`
source	`<AWSReservedSSO_* role node (Role)>`
target	`<FederatedIdentity node representing the IAM Identity Center OIDC endpoint>`

Narrative

Provisioned SSO role {role.name} in account {account.name} trusts the IAM Identity Center OIDC endpoint (signin.aws.amazon.com or regional oidc.sso.REGION.amazonaws.com) to issue credentials to principals authenticated through the SSO portal/CLI.

Raw rule rules/explicit/aws-sso.yaml

id: aws-sso-provisioned-role-trusts-sso-oidc
emits: TrustsExternalIdentity
applies_to:
- aws
match_record:
  resource_type: AWS::IAM::Role
  field: AssumeRolePolicyDocument
where:
- role name starts_with 'AWSReservedSSO_'
- trust policy Principal Federated includes 'signin.aws.amazon.com' OR matches 'oidc.sso.*.amazonaws.com'
emit:
  source_type: Role
  target_type: FederatedIdentity
  source: <AWSReservedSSO_* role node (Role)>
  target: <FederatedIdentity node representing the IAM Identity Center OIDC endpoint>
  api_source: iam:ListRoles + iam:GetRole (AssumeRolePolicyDocument) in each member account
  evidence_field: AssumeRolePolicyDocument.Statement[].Principal.Federated
  narrative: Provisioned SSO role {role.name} in account {account.name} trusts the IAM Identity Center
    OIDC endpoint (signin.aws.amazon.com or regional oidc.sso.REGION.amazonaws.com) to issue credentials
    to principals authenticated through the SSO portal/CLI.