2 ms·
It's not a good look to have the first line in the "alerts" be that the OrganizationAccountAccessRole exists in a member account, and twice as bad that there ar
by mdaniel 4y ago
It's not a good look to have the first line in the "alerts" be that the OrganizationAccountAccessRole exists in a member account, and twice as bad that there are 2 _different_ alerts, one Critical and one High for the exact same OAAR situation
Maybe there's some nuance that the role just happens to be named that and there's in fact no AWS Organizations relationship, but for demo purposes, best to either include some disambiguation that would show a user that such introspection exists or pick a less wtf scenario for "3rd party access"
- varunjain99 4y agoThanks for the feedback! You're right that this is a bit of a false positive. For the sandbox, since we've hooked up 1 account, it flags such org trust relationships. I'd figured that it'd be good to showcase a 3rd party account access even as a false positive. I'll update this rule to deal with org relationships correctly for 1-account setup, and will set up a separate account to have 3rd party access.