rage.fail

control-boundary-via-iam-admin

Ability to grant permissions at a boundary scope = control of that boundary.

derived any cloud emits Controls

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'attacker': None} CanGrantPermission {'principal': None}

where

scope_of(?attacker, CanGrantPermission) is a boundary

emit

source type	`Identity`
target type	`*`
source	`?attacker`
target	`<boundary of the grant scope>`
state logic	ACTIVE

Raw rule rules/derived/can-control.yaml

id: control-boundary-via-iam-admin
emits: Controls
description: Ability to grant permissions at a boundary scope = control of that boundary.
applies_to:
- '*'
match:
- - attacker: null
  - CanGrantPermission
  - principal: null
where:
- scope_of(?attacker, CanGrantPermission) is a boundary
emit:
  source_type: Identity
  target_type: '*'
  source: ?attacker
  target: <boundary of the grant scope>
  state_logic: ACTIVE
  derived_from:
  - ?attacker CanGrantPermission ?principal @boundary
  evidence:
    narrative_template: '{attacker.name} can assign roles/permissions at {boundary.name} scope and can
      therefore grant itself full control of {boundary.name}.

      '