ghndrx/prowler
1
0
Fork 0
mirror of https://github.com/ghndrx/prowler.git synced 2026-02-10 14:55:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Solve IAM policy Errors (#1692)

Browse Source 
Co-authored-by: sergargar <sergio@verica.io>
This commit is contained in:
Sergio Garcia
2023-01-12 17:39:09 +01:00
committed by GitHub
parent 12f1eaace7
commit c9436da235
4 changed files with 21 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
prowler/providers/aws/services/codebuild/codebuild_service.py
View File

@@ -58,11 +58,12 @@ class Codebuild:
if project.region == region:
ids = client.list_builds_for_project(projectName=project.name)
if "ids" in ids:
builds = client.batch_get_builds(ids=[ids["ids"][0]])
if "builds" in builds:
project.last_invoked_time = builds["builds"][0][
"endTime"
]
if len(ids["ids"]) > 0:
builds = client.batch_get_builds(ids=[ids["ids"][0]])
if "builds" in builds:
project.last_invoked_time = builds["builds"][0][
"endTime"
]
projects = client.batch_get_projects(names=[project.name])[
"projects"

6
prowler/providers/aws/services/iam/iam_no_custom_policy_permissive_role_assumption/iam_no_custom_policy_permissive_role_assumption.py
View File

@@ -12,7 +12,11 @@ class iam_no_custom_policy_permissive_role_assumption(Check):
report.resource_id = iam_client.policies[index]["PolicyName"]
report.status = "PASS"
report.status_extended = f"Custom Policy {iam_client.policies[index]['PolicyName']} does not allow permissive STS Role assumption"
for statement in policy_document["Statement"]:
if type(policy_document["Statement"]) != list:
policy_statements = [policy_document["Statement"]]
else:
policy_statements = policy_document["Statement"]
for statement in policy_statements:
if (
statement["Effect"] == "Allow"
and "Action" in statement

6
prowler/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation.py
View File

@@ -72,7 +72,11 @@ class iam_policy_allows_privilege_escalation(Check):
denied_not_actions = set()
# Recover all policy actions
for statements in policy["PolicyDocument"]["Statement"]:
if type(policy["PolicyDocument"]["Statement"]) != list:
policy_statements = [policy["PolicyDocument"]["Statement"]]
else:
policy_statements = policy["PolicyDocument"]["Statement"]
for statements in policy_statements:
# Recover allowed actions
if statements["Effect"] == "Allow":
if "Action" in statements:

6
prowler/providers/aws/services/iam/iam_policy_no_administrative_privileges/iam_policy_no_administrative_privileges.py
View File

@@ -13,7 +13,11 @@ class iam_policy_no_administrative_privileges(Check):
report.status = "PASS"
report.status_extended = f"Policy {iam_client.policies[index]['PolicyName']} does not allow '*:*' administrative privileges"
# Check the statements, if one includes *:* stop iterating over the rest
for statement in policy_document["Statement"]:
if type(policy_document["Statement"]) != list:
policy_statements = [policy_document["Statement"]]
else:
policy_statements = policy_document["Statement"]
for statement in policy_statements:
if (
statement["Effect"] == "Allow"
and "Action" in statement