ghndrx/prowler
1
0
Fork 0
mirror of https://github.com/ghndrx/prowler.git synced 2026-02-10 14:55:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(aws): check all conditions in IAM policy parser (#3006)

Browse Source 
Co-authored-by: John Mastron <jmastron@jpl.nasa.gov>
Co-authored-by: Sergio Garcia <sergargar1@gmail.com>
This commit is contained in:
John Mastron
2023-11-07 01:40:34 -08:00
committed by GitHub
parent 12b45c6896
commit ec01b62a82
2 changed files with 77 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
prowler/providers/aws/lib/policy_condition_parser/policy_condition_parser.py
View File

@@ -56,12 +56,15 @@ def is_account_only_allowed_in_condition(
): ):
# if there is an arn/account without the source account -> we do not consider it safe # if there is an arn/account without the source account -> we do not consider it safe
# here by default we assume is true and look for false entries # here by default we assume is true and look for false entries
is_condition_valid = True is_condition_key_restrictive = True
for item in condition_statement[condition_operator][value]: for item in condition_statement[condition_operator][value]:
if source_account not in item: if source_account not in item:
is_condition_valid = False is_condition_key_restrictive = False
break break
if is_condition_key_restrictive:
is_condition_valid = True
# value is a string # value is a string
elif isinstance( elif isinstance(
condition_statement[condition_operator][value], condition_statement[condition_operator][value],

72
tests/providers/aws/lib/policy_condition_parser/policy_condition_parser_test.py
View File

@@ -1282,3 +1282,75 @@ class Test_policy_condition_parser:
assert not is_account_only_allowed_in_condition( assert not is_account_only_allowed_in_condition(
condition_statement, TRUSTED_AWS_ACCOUNT_NUMBER condition_statement, TRUSTED_AWS_ACCOUNT_NUMBER
) )
def test_condition_parser_two_lists_unrestrictive(self):
condition_statement = {
"StringLike": {
"AWS:ResourceAccount": [
TRUSTED_AWS_ACCOUNT_NUMBER,
NON_TRUSTED_AWS_ACCOUNT_NUMBER,
]
},
"ArnLike": {
"AWS:SourceArn": [
f"arn:aws:cloudtrail:*:{TRUSTED_AWS_ACCOUNT_NUMBER}:trail/*",
f"arn:aws:cloudtrail:*:{NON_TRUSTED_AWS_ACCOUNT_NUMBER}:trail/*",
]
},
}
assert not is_account_only_allowed_in_condition(
condition_statement, TRUSTED_AWS_ACCOUNT_NUMBER
)
def test_condition_parser_two_lists_both_restrictive(self):
condition_statement = {
"StringLike": {
"AWS:ResourceAccount": [
TRUSTED_AWS_ACCOUNT_NUMBER,
]
},
"ArnLike": {
"AWS:SourceArn": [
f"arn:aws:cloudtrail:*:{TRUSTED_AWS_ACCOUNT_NUMBER}:trail/*",
]
},
}
assert is_account_only_allowed_in_condition(
condition_statement, TRUSTED_AWS_ACCOUNT_NUMBER
)
def test_condition_parser_two_lists_first_restrictive(self):
condition_statement = {
"StringLike": {
"AWS:ResourceAccount": [
TRUSTED_AWS_ACCOUNT_NUMBER,
]
},
"ArnLike": {
"AWS:SourceArn": [
f"arn:aws:cloudtrail:*:{TRUSTED_AWS_ACCOUNT_NUMBER}:trail/*",
f"arn:aws:cloudtrail:*:{NON_TRUSTED_AWS_ACCOUNT_NUMBER}:trail/*",
]
},
}
assert is_account_only_allowed_in_condition(
condition_statement, TRUSTED_AWS_ACCOUNT_NUMBER
)
def test_condition_parser_two_lists_second_restrictive(self):
condition_statement = {
"StringLike": {
"AWS:ResourceAccount": [
TRUSTED_AWS_ACCOUNT_NUMBER,
NON_TRUSTED_AWS_ACCOUNT_NUMBER,
]
},
"ArnLike": {
"AWS:SourceArn": [
f"arn:aws:cloudtrail:*:{TRUSTED_AWS_ACCOUNT_NUMBER}:trail/*",
]
},
}
assert is_account_only_allowed_in_condition(
condition_statement, TRUSTED_AWS_ACCOUNT_NUMBER
)