ghndrx/prowler
1
0
Fork 0
mirror of https://github.com/ghndrx/prowler.git synced 2026-02-10 14:55:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(iam_policy_no_administrative_privileges): check only *:* permissions (#1802)

Browse Source
This commit is contained in:
Sergio Garcia
2023-01-30 16:47:09 +01:00
committed by GitHub
parent 552e0fefc3
commit 4e879271a0
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
prowler/providers/aws/services/iam/iam_policy_no_administrative_privileges/iam_policy_no_administrative_privileges.py
View File

@@ -18,15 +18,15 @@ class iam_policy_no_administrative_privileges(Check):
else:
policy_statements = policy["PolicyDocument"]["Statement"]
for statement in policy_statements:
# Check policies with "Effect": "Allow" with "Action": "*" over "Resource": "*".
if (
statement["Effect"] == "Allow"
and "Action" in statement
and "*" in statement["Action"]
and "*" in statement["Resource"]
and (statement["Action"] == "*" or statement["Action"] == ["*"])
and (statement["Resource"] == "*" or statement["Resource"] == ["*"])
):
report.status = "FAIL"
report.status_extended = f"Policy {policy['PolicyName']} allows '*:*' administrative privileges"
break
findings.append(report)
return findings

2
tests/providers/aws/services/iam/iam_policy_no_administrative_privileges/iam_policy_no_administrative_privileges_test.py
View File

@@ -83,7 +83,7 @@ class Test_iam_policy_no_administrative_privileges_test:
policy_document_non_administrative = {
"Version": "2012-10-17",
"Statement": [
{"Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "*"},
{"Effect": "Allow", "Action": "logs:*", "Resource": "*"},
],
}
policy_name_administrative = "policy2"