rage.fail

credential-authenticates-to-service

Reading a credential that is credentials for a data/messaging service endpoint lets the reader authenticate to that endpoint.

derived any cloud emits AuthenticatesTo

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanReadCredential {'credential': None} {'credential': None} CredentialsFor {'target': None}

where

node_class(?target) in [Data, Messaging] # DB/queue/service endpoints, not identities (those -> CanImpersonate)

emit

source type	`Identity`
target type	`Data`
source	`?principal`
target	`?target`
conditions	`iam_permission` `resource_policy`

Narrative

{principal.name} can read {credential.name}, which authenticates to {target.name}.

Raw rule rules/derived/capability-completions.yaml

id: credential-authenticates-to-service
emits: AuthenticatesTo
description: Reading a credential that is credentials for a data/messaging service endpoint lets the reader
  authenticate to that endpoint.
applies_to:
- '*'
match:
- - principal: null
  - CanReadCredential
  - credential: null
- - credential: null
  - CredentialsFor
  - target: null
where:
- 'node_class(?target) in [Data, Messaging]  # DB/queue/service endpoints, not identities (those -> CanImpersonate)'
emit:
  source_type: Identity
  target_type: Data
  source: ?principal
  target: ?target
  conditions:
  - iam_permission
  - resource_policy
  derived_from:
  - ?principal CanReadCredential ?credential
  - ?credential CredentialsFor ?target
  narrative: '{principal.name} can read {credential.name}, which authenticates to {target.name}.'