rage.fail

aws-sso-user-member-of-group

explicit aws emits MemberOf

match (record)

{ "field": "MemberId.UserId", "resource_type": "AWS::IdentityStore::GroupMembership" }

emit

source type	`Identity`
target type	`Group`
source	`<Identity Store User node (HumanIdentity)>`
target	`<Identity Store Group node (Group)>`

Narrative

{user.name} is a member of Identity Store group {group.name} and inherits all account assignments the group holds.

Raw rule rules/explicit/aws-sso.yaml

id: aws-sso-user-member-of-group
emits: MemberOf
applies_to:
- aws
match_record:
  resource_type: AWS::IdentityStore::GroupMembership
  field: MemberId.UserId
emit:
  source_type: Identity
  target_type: Group
  source: <Identity Store User node (HumanIdentity)>
  target: <Identity Store Group node (Group)>
  api_source: identitystore:ListGroupMembershipsForMember
  evidence_field: GroupMemberships[].GroupId
  narrative: '{user.name} is a member of Identity Store group {group.name} and inherits all account assignments
    the group holds.'