Allow referencing existing Defender resources

[shahnami]

https://linear.app/openzeppelin-development/issue/PLAT-2817/allow-defender-as-code-to-reference-existing-resources

[MCarlomagno]

LGTM, my only concern is about security, is it possible to reference resources from another tenant? Let's say I see the actionId from another tenant in the forum and I attack that tenant triggering that action using a monitor from my own tenant, would that be possible?

[shahnami]

LGTM, my only concern is about security, is it possible to reference resources from another tenant? Let's say I see the actionId from another tenant in the forum and I attack that tenant triggering that action using a monitor from my own tenant, would that be possible?

These are secured by tenant-scoped API keys (since it uses defender-sdk). When a reference is made, we try to pull that data in during, for example, the deploy, but if the user doesn't have access to that resource, the authoriser will throw.