rage.fail

aws-sso-trusted-token-issuer-trust

explicit aws emits TrustsExternalIdentity

match (record)

{ "field": "TrustedTokenIssuerConfiguration.OidcJwtConfiguration.IssuerUrl", "resource_type": "AWS::SSO::TrustedTokenIssuer" }

emit

source type	`ResourcePolicy`
target type	`FederatedIdentity`
source	`<ResourcePolicy node representing the SSO instance's trusted issuer configuration (keyed by instance ARN + '/trusted-issuer/' + IssuerUrl)>`
target	`<FederatedIdentity node representing the external OIDC issuer at IssuerUrl>`

Narrative

IAM Identity Center instance {instance.name}'s trusted issuer configuration (ResourcePolicy) trusts external OIDC issuer {issuer_url} as a trusted token issuer; tokens from this issuer are accepted for context-aware access evaluation.

Raw rule rules/explicit/aws-sso.yaml

id: aws-sso-trusted-token-issuer-trust
emits: TrustsExternalIdentity
applies_to:
- aws
match_record:
  resource_type: AWS::SSO::TrustedTokenIssuer
  field: TrustedTokenIssuerConfiguration.OidcJwtConfiguration.IssuerUrl
emit:
  source_type: ResourcePolicy
  target_type: FederatedIdentity
  source: <ResourcePolicy node representing the SSO instance's trusted issuer configuration (keyed by
    instance ARN + '/trusted-issuer/' + IssuerUrl)>
  target: <FederatedIdentity node representing the external OIDC issuer at IssuerUrl>
  api_source: sso-admin:ListTrustedTokenIssuers + sso-admin:DescribeTrustedTokenIssuer
  evidence_field: TrustedTokenIssuerConfiguration.OidcJwtConfiguration.IssuerUrl
  narrative: IAM Identity Center instance {instance.name}'s trusted issuer configuration (ResourcePolicy)
    trusts external OIDC issuer {issuer_url} as a trusted token issuer; tokens from this issuer are accepted
    for context-aware access evaluation.