mirror of
https://github.com/ghndrx/prowler.git
synced 2026-02-10 14:55:00 +00:00
feat(iam): add iam_role_cross_account_readonlyaccess_policy check (#2312)
This commit is contained in:
Sergio Garcia
@@ -0,0 +1,284 @@
|
||||
from json import dumps
|
||||
from unittest import mock
|
||||
|
||||
from boto3 import client, session
|
||||
from moto import mock_iam
|
||||
|
||||
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
|
||||
from prowler.providers.aws.services.iam.iam_service import Role
|
||||
|
||||
AWS_REGION = "us-east-1"
|
||||
AWS_ACCOUNT_ID = "123456789012"
|
||||
|
||||
|
||||
class Test_iam_role_cross_account_readonlyaccess_policy:
|
||||
def set_mocked_audit_info(self):
|
||||
audit_info = AWS_Audit_Info(
|
||||
session_config=None,
|
||||
original_session=None,
|
||||
audit_session=session.Session(
|
||||
profile_name=None,
|
||||
botocore_session=None,
|
||||
),
|
||||
audited_account=AWS_ACCOUNT_ID,
|
||||
audited_user_id=None,
|
||||
audited_partition="aws",
|
||||
audited_identity_arn=None,
|
||||
profile=None,
|
||||
profile_region=None,
|
||||
credentials=None,
|
||||
assumed_role_info=None,
|
||||
audited_regions=["us-east-1", "eu-west-1"],
|
||||
organizations_metadata=None,
|
||||
audit_resources=None,
|
||||
)
|
||||
|
||||
return audit_info
|
||||
|
||||
@mock_iam
|
||||
def test_no_roles(self):
|
||||
from prowler.providers.aws.services.iam.iam_service import IAM
|
||||
|
||||
current_audit_info = self.set_mocked_audit_info()
|
||||
with mock.patch(
|
||||
"prowler.providers.aws.lib.audit_info.audit_info.current_audit_info",
|
||||
new=current_audit_info,
|
||||
), mock.patch(
|
||||
"prowler.providers.aws.services.iam.iam_role_cross_account_readonlyaccess_policy.iam_role_cross_account_readonlyaccess_policy.iam_client",
|
||||
new=IAM(current_audit_info),
|
||||
):
|
||||
# Test Check
|
||||
from prowler.providers.aws.services.iam.iam_role_cross_account_readonlyaccess_policy.iam_role_cross_account_readonlyaccess_policy import (
|
||||
iam_role_cross_account_readonlyaccess_policy,
|
||||
)
|
||||
|
||||
check = iam_role_cross_account_readonlyaccess_policy()
|
||||
result = check.execute()
|
||||
assert len(result) == 0
|
||||
|
||||
@mock_iam
|
||||
def test_role_without_readonlyaccess_policy(self):
|
||||
iam = client("iam")
|
||||
role_name = "test"
|
||||
assume_role_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": {
|
||||
"Sid": "test",
|
||||
"Effect": "Allow",
|
||||
"Principal": {"AWS": f"arn:aws:iam::{AWS_ACCOUNT_ID}:root"},
|
||||
"Action": "sts:AssumeRole",
|
||||
},
|
||||
}
|
||||
response = iam.create_role(
|
||||
RoleName=role_name,
|
||||
AssumeRolePolicyDocument=dumps(assume_role_policy_document),
|
||||
)
|
||||
|
||||
current_audit_info = self.set_mocked_audit_info()
|
||||
from prowler.providers.aws.services.iam.iam_service import IAM
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.aws.lib.audit_info.audit_info.current_audit_info",
|
||||
new=current_audit_info,
|
||||
), mock.patch(
|
||||
"prowler.providers.aws.services.iam.iam_role_cross_account_readonlyaccess_policy.iam_role_cross_account_readonlyaccess_policy.iam_client",
|
||||
new=IAM(current_audit_info),
|
||||
):
|
||||
# Test Check
|
||||
from prowler.providers.aws.services.iam.iam_role_cross_account_readonlyaccess_policy.iam_role_cross_account_readonlyaccess_policy import (
|
||||
iam_role_cross_account_readonlyaccess_policy,
|
||||
)
|
||||
|
||||
check = iam_role_cross_account_readonlyaccess_policy()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "IAM Role test has not ReadOnlyAccess policy"
|
||||
)
|
||||
assert result[0].resource_id == "test"
|
||||
assert result[0].resource_arn == response["Role"]["Arn"]
|
||||
assert result[0].resource_tags == []
|
||||
|
||||
@mock_iam
|
||||
def test_internal_role_with_readonlyaccess_policy(self):
|
||||
iam = client("iam")
|
||||
role_name = "test"
|
||||
assume_role_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": {
|
||||
"Sid": "test",
|
||||
"Effect": "Allow",
|
||||
"Principal": {"AWS": f"arn:aws:iam::{AWS_ACCOUNT_ID}:root"},
|
||||
"Action": "sts:AssumeRole",
|
||||
},
|
||||
}
|
||||
response = iam.create_role(
|
||||
RoleName=role_name,
|
||||
AssumeRolePolicyDocument=dumps(assume_role_policy_document),
|
||||
)
|
||||
iam.attach_role_policy(
|
||||
RoleName=role_name,
|
||||
PolicyArn="arn:aws:iam::aws:policy/ReadOnlyAccess",
|
||||
)
|
||||
|
||||
current_audit_info = self.set_mocked_audit_info()
|
||||
from prowler.providers.aws.services.iam.iam_service import IAM
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.aws.lib.audit_info.audit_info.current_audit_info",
|
||||
new=current_audit_info,
|
||||
), mock.patch(
|
||||
"prowler.providers.aws.services.iam.iam_role_cross_account_readonlyaccess_policy.iam_role_cross_account_readonlyaccess_policy.iam_client",
|
||||
new=IAM(current_audit_info),
|
||||
):
|
||||
# Test Check
|
||||
from prowler.providers.aws.services.iam.iam_role_cross_account_readonlyaccess_policy.iam_role_cross_account_readonlyaccess_policy import (
|
||||
iam_role_cross_account_readonlyaccess_policy,
|
||||
)
|
||||
|
||||
check = iam_role_cross_account_readonlyaccess_policy()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "IAM Role test has read-only access but is not cross account"
|
||||
)
|
||||
assert result[0].resource_id == "test"
|
||||
assert result[0].resource_arn == response["Role"]["Arn"]
|
||||
assert result[0].resource_tags == []
|
||||
|
||||
@mock_iam
|
||||
def test_cross_account_role_with_readonlyaccess_policy(self):
|
||||
iam = client("iam")
|
||||
role_name = "test"
|
||||
assume_role_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": {
|
||||
"Sid": "test",
|
||||
"Effect": "Allow",
|
||||
"Principal": {"AWS": "arn:aws:iam::012345678910:root"},
|
||||
"Action": "sts:AssumeRole",
|
||||
},
|
||||
}
|
||||
response = iam.create_role(
|
||||
RoleName=role_name,
|
||||
AssumeRolePolicyDocument=dumps(assume_role_policy_document),
|
||||
)
|
||||
iam.attach_role_policy(
|
||||
RoleName=role_name,
|
||||
PolicyArn="arn:aws:iam::aws:policy/ReadOnlyAccess",
|
||||
)
|
||||
|
||||
current_audit_info = self.set_mocked_audit_info()
|
||||
from prowler.providers.aws.services.iam.iam_service import IAM
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.aws.lib.audit_info.audit_info.current_audit_info",
|
||||
new=current_audit_info,
|
||||
), mock.patch(
|
||||
"prowler.providers.aws.services.iam.iam_role_cross_account_readonlyaccess_policy.iam_role_cross_account_readonlyaccess_policy.iam_client",
|
||||
new=IAM(current_audit_info),
|
||||
):
|
||||
# Test Check
|
||||
from prowler.providers.aws.services.iam.iam_role_cross_account_readonlyaccess_policy.iam_role_cross_account_readonlyaccess_policy import (
|
||||
iam_role_cross_account_readonlyaccess_policy,
|
||||
)
|
||||
|
||||
check = iam_role_cross_account_readonlyaccess_policy()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "IAM Role test gives cross account read-only access!"
|
||||
)
|
||||
assert result[0].resource_id == "test"
|
||||
assert result[0].resource_arn == response["Role"]["Arn"]
|
||||
assert result[0].resource_tags == []
|
||||
|
||||
@mock_iam
|
||||
def test_asterisk_cross_account_role_with_readonlyaccess_policy(self):
|
||||
iam = client("iam")
|
||||
role_name = "test"
|
||||
assume_role_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": {
|
||||
"Sid": "test",
|
||||
"Effect": "Allow",
|
||||
"Principal": {"AWS": "*"},
|
||||
"Action": "sts:AssumeRole",
|
||||
},
|
||||
}
|
||||
response = iam.create_role(
|
||||
RoleName=role_name,
|
||||
AssumeRolePolicyDocument=dumps(assume_role_policy_document),
|
||||
)
|
||||
iam.attach_role_policy(
|
||||
RoleName=role_name,
|
||||
PolicyArn="arn:aws:iam::aws:policy/ReadOnlyAccess",
|
||||
)
|
||||
|
||||
current_audit_info = self.set_mocked_audit_info()
|
||||
from prowler.providers.aws.services.iam.iam_service import IAM
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.aws.lib.audit_info.audit_info.current_audit_info",
|
||||
new=current_audit_info,
|
||||
), mock.patch(
|
||||
"prowler.providers.aws.services.iam.iam_role_cross_account_readonlyaccess_policy.iam_role_cross_account_readonlyaccess_policy.iam_client",
|
||||
new=IAM(current_audit_info),
|
||||
):
|
||||
# Test Check
|
||||
from prowler.providers.aws.services.iam.iam_role_cross_account_readonlyaccess_policy.iam_role_cross_account_readonlyaccess_policy import (
|
||||
iam_role_cross_account_readonlyaccess_policy,
|
||||
)
|
||||
|
||||
check = iam_role_cross_account_readonlyaccess_policy()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "IAM Role test gives cross account read-only access!"
|
||||
)
|
||||
assert result[0].resource_id == "test"
|
||||
assert result[0].resource_arn == response["Role"]["Arn"]
|
||||
assert result[0].resource_tags == []
|
||||
|
||||
@mock_iam
|
||||
def test_only_aws_service_linked_roles(self):
|
||||
iam_client = mock.MagicMock
|
||||
iam_client.roles = []
|
||||
iam_client.roles.append(
|
||||
Role(
|
||||
name="AWSServiceRoleForAmazonGuardDuty",
|
||||
arn="arn:aws:iam::106908755756:role/aws-service-role/guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDuty",
|
||||
assume_role_policy={
|
||||
"Version": "2008-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Principal": {"Service": "ec2.amazonaws.com"},
|
||||
"Action": "sts:AssumeRole",
|
||||
}
|
||||
],
|
||||
},
|
||||
is_service_role=True,
|
||||
)
|
||||
)
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.aws.services.iam.iam_service.IAM",
|
||||
iam_client,
|
||||
):
|
||||
# Test Check
|
||||
from prowler.providers.aws.services.iam.iam_role_cross_account_readonlyaccess_policy.iam_role_cross_account_readonlyaccess_policy import (
|
||||
iam_role_cross_account_readonlyaccess_policy,
|
||||
)
|
||||
|
||||
check = iam_role_cross_account_readonlyaccess_policy()
|
||||
result = check.execute()
|
||||
assert len(result) == 0
|
||||
@@ -518,6 +518,43 @@ class Test_IAM_Service:
|
||||
iam.groups[0].attached_policies[0]["PolicyArn"] == policy["Policy"]["Arn"]
|
||||
)
|
||||
|
||||
# Test IAM List Attached Role Policies
|
||||
@mock_iam
|
||||
def test__list_attached_role_policies__(self):
|
||||
iam = client("iam")
|
||||
role_name = "test"
|
||||
assume_role_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": {
|
||||
"Sid": "test",
|
||||
"Effect": "Allow",
|
||||
"Principal": {"AWS": "*"},
|
||||
"Action": "sts:AssumeRole",
|
||||
},
|
||||
}
|
||||
response = iam.create_role(
|
||||
RoleName=role_name,
|
||||
AssumeRolePolicyDocument=dumps(assume_role_policy_document),
|
||||
)
|
||||
iam.attach_role_policy(
|
||||
RoleName=role_name,
|
||||
PolicyArn="arn:aws:iam::aws:policy/ReadOnlyAccess",
|
||||
)
|
||||
|
||||
# IAM client for this test class
|
||||
audit_info = self.set_mocked_audit_info()
|
||||
iam = IAM(audit_info)
|
||||
|
||||
assert len(iam.roles) == 1
|
||||
assert iam.roles[0].name == role_name
|
||||
assert iam.roles[0].arn == response["Role"]["Arn"]
|
||||
assert len(iam.roles[0].attached_policies) == 1
|
||||
assert iam.roles[0].attached_policies[0]["PolicyName"] == "ReadOnlyAccess"
|
||||
assert (
|
||||
iam.roles[0].attached_policies[0]["PolicyArn"]
|
||||
== "arn:aws:iam::aws:policy/ReadOnlyAccess"
|
||||
)
|
||||
|
||||
@mock_iam
|
||||
def test__get_entities_attached_to_support_roles__no_roles(self):
|
||||
iam_client = client("iam")
|
||||
|
||||
Reference in New Issue
Block a user