rage.fail

HasPolicy

A policy artifact is attached to a principal/resource. Feeds the permission evaluator; not walked directly.

identity_authz AUTHORIZATION nature: explicit not walkable

Identity, * ── HasPolicy ──▸ Policy

Source types

Identity*

Target types

Policy

States

ACTIVE CONDITIONAL POTENTIAL BLOCKED UNKNOWN

Derivation

nature	explicit

Rules that emit HasPolicy 55

aws-account-oaar-trust-policy

awsexplicit

aws-account-oaar-admin-policy

awsexplicit

aws-account-attached-scp

awsexplicit

aws-acmpca-ca-has-policy

awsexplicit

aws-cc-approval-rule-template-assoc

awsexplicit

aws-ct-control-backing-scp

awsexplicit

aws-ct-control-attached-to-ou

awsexplicit

aws-kms-has-key-policy

awsexplicit

aws-opensearch-resource-policy

awsexplicit

aws-secretsmanager-wrapped-by-key

awsexplicit

aws-sqs-queue-has-policy

awsexplicit

aws-sso-permset-has-managed-policy

awsexplicit

aws-sso-permset-has-inline-policy

awsexplicit

aws-sso-permset-has-boundary

awsexplicit

azure-bp-deny-assignment-attached

azureexplicit

azure-cosmosdb-network-properties

azureexplicit

azure-cosmosdb-cmk-property

azureexplicit

azure-evg-topic-private-endpoint

azureexplicit

azure-evg-topic-network-access-policy

azureexplicit

azure-evg-topic-local-auth-policy

azureexplicit

azure-evg-partner-topic-activated

azureexplicit

azure-evg-namespace-permission-binding

azureexplicit

azure-kv-access-policy-artifact

azureexplicit

azure-kv-network-acls

azureexplicit

azure-lighthouse-assignment-policy

azureexplicit

azure-la-trigger-ip-allowlist

azureexplicit

azure-mhsm-local-role-assignment

azureexplicit

azure-mg-policy-assignment-artifact

azureexplicit

azure-mg-deny-assignment-artifact

azureexplicit

azure-storage-allow-public-access-property

azureexplicit

azure-storage-container-public-access-property

azureexplicit

azure-storage-network-acls-property

azureexplicit

azure-sub-deny-assignment

azureexplicit

azure-sub-deny-policy-assignment

azureexplicit

gcp-acm-access-policy-node

gcpexplicit

gcp-acm-perimeter-has-policy

gcpexplicit

gcp-acm-perimeter-blocks-project

gcpexplicit

gcp-acm-access-level-node

gcpexplicit

gcp-acm-ingress-rule-references-access-level

gcpexplicit

gcp-ar-has-policy

gcpexplicit

gcp-certmanager-ca-pool-has-policy

gcpexplicit

gcp-certmanager-template-has-policy

gcpexplicit

gcp-eventarc-explicit-trigger-has-policy

An Eventarc trigger has an IAM allow policy governing who may manage it.

gcpexplicit

gcp-eventarc-explicit-bus-has-policy

An Eventarc Advanced message bus has an IAM allow policy governing who may publish to it.

gcpexplicit

gcp-filestore-explicit-nfs-export-options

gcpexplicit

gcp-firestore-explicit-has-policy

gcpexplicit

gcp-gcs-has-policy

gcpexplicit

gcp-kms-has-policy

gcpexplicit

gcp-kms-keyring-has-policy

gcpexplicit

gcp-memorystore-explicit-auth-enabled

gcpexplicit

gcp-orgpolicy-has-policy

gcpexplicit

gcp-orgpolicy-custom-constraint-node

gcpexplicit

gcp-psc-service-attachment-has-policy

gcpexplicit

gcp-secretmanager-has-policy

gcpexplicit

gcp-sr-has-policy

gcpexplicit