rage.fail

create-modify-yields-replace

A principal that can create a resource type and modify the instance can delete+recreate it to inherit its identity/trust.

derived any cloud emits CanReplace

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanCreate {'resource': None} {'principal': None} CanModify {'resource': None}

emit

source type	`Identity`
target type	`*`
source	`?principal`
target	`?resource`
conditions	`iam_permission`

Narrative

{principal.name} can create and modify {resource.name}, so it can delete+recreate it to inherit its identity/trust.

Raw rule rules/derived/capability-completions.yaml

id: create-modify-yields-replace
emits: CanReplace
description: A principal that can create a resource type and modify the instance can delete+recreate it
  to inherit its identity/trust.
applies_to:
- '*'
match:
- - principal: null
  - CanCreate
  - resource: null
- - principal: null
  - CanModify
  - resource: null
emit:
  source_type: Identity
  target_type: '*'
  source: ?principal
  target: ?resource
  conditions:
  - iam_permission
  derived_from:
  - ?principal CanCreate ?resource
  - ?principal CanModify ?resource
  narrative: '{principal.name} can create and modify {resource.name}, so it can delete+recreate it to
    inherit its identity/trust.'