mirror of
https://github.com/ghndrx/prowler.git
synced 2026-02-10 23:05:05 +00:00
83 lines
4.1 KiB
Bash
83 lines
4.1 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
|
|
#
|
|
# This check was contributed by Nick Malcolm (github.com/nickmalcolm), building
|
|
# on the hard work of others.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
|
# use this file except in compliance with the License. You may obtain a copy
|
|
# of the License at http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software distributed
|
|
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
|
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations under the License.
|
|
|
|
CHECK_ID_extra7100="7.100"
|
|
CHECK_TITLE_extra7100="[extra7100] Ensure that no custom IAM policies exist which allow permissive role assumption (e.g. sts:AssumeRole on *)"
|
|
CHECK_SCORED_extra7100="NOT_SCORED"
|
|
CHECK_TYPE_extra7100="EXTRA"
|
|
CHECK_SEVERITY_extra7100="Critical"
|
|
CHECK_ASFF_RESOURCE_TYPE_extra7100="AwsIamPolicy"
|
|
CHECK_ALTERNATE_check7100="extra7100"
|
|
CHECK_ASFF_COMPLIANCE_TYPE_extra7100="ens-op.acc.2.aws.iam.1"
|
|
CHECK_SERVICENAME_extra7100="iam"
|
|
CHECK_RISK_extra7100='If not restricted unintended access could happen.'
|
|
CHECK_REMEDIATION_extra7100='Use the least privilege principle when granting permissions.'
|
|
CHECK_DOC_extra7100='https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html'
|
|
CHECK_CAF_EPIC_extra7100='IAM'
|
|
|
|
extra7100(){
|
|
# "Ensure that no custom policies exist which permit assuming any role (e.g. sts:AssumeRole on *)"
|
|
#
|
|
# A permissive STS Role assumption policy is one where the Resource (ARN) is not explicitly defined
|
|
# This is most often seen as sts:assumeRole on *, but can take other forms.
|
|
#
|
|
# Learn more: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_permissions-to-switch.html#roles-usingrole-createpolicy
|
|
LIST_CUSTOM_POLICIES=$($AWSCLI iam list-policies --output text $PROFILE_OPT --region $REGION --scope Local --query 'Policies[*].[Arn,DefaultVersionId]' | grep -v -e '^None$' | awk -F '\t' '{print $1","$2"\n"}')
|
|
if [[ $LIST_CUSTOM_POLICIES ]]; then
|
|
for policy in $LIST_CUSTOM_POLICIES; do
|
|
POLICY_ARN=$(echo $policy | awk -F ',' '{print $1}')
|
|
POLICY_VERSION=$(echo $policy | awk -F ',' '{print $2}')
|
|
|
|
POLICY_STATEMENTS_WITH_ALLOW=$($AWSCLI iam get-policy-version \
|
|
--output json \
|
|
--policy-arn $POLICY_ARN \
|
|
--version-id $POLICY_VERSION \
|
|
--query "[PolicyVersion.Document.Statement] | [] | [?Effect == 'Allow']" \
|
|
$PROFILE_OPT \
|
|
--region $REGION
|
|
)
|
|
|
|
# Identify permissive policies by:
|
|
# 1 & 2) Casting all the Resource and Action keys to Arrays (sometimes they're a single string)
|
|
# 3) Iterate over the policy statements
|
|
# 4) Narrow the scope to Actions which are sts:* or sts:assumeRole(WithSAML|WithWebIdentity)
|
|
# 5) Narrow the scope to Resources (IAM Roles) which include a wildcard
|
|
POLICY_WITH_PERMISSIVE_STS=$(echo $POLICY_STATEMENTS_WITH_ALLOW \
|
|
| jq 'map( .Resource |= (if type=="array" then . else [.] end) )' \
|
|
| jq 'map( .Action |= (if type=="array" then . else [.] end) )' \
|
|
| jq '.[]' \
|
|
| jq 'select(.Action[] | contains("sts:AssumeRole") or contains("sts:*"))' \
|
|
| jq 'select(.Resource[] | contains("*"))')
|
|
|
|
if [[ $POLICY_WITH_PERMISSIVE_STS ]]; then
|
|
PERMISSIVE_POLICIES_LIST="$PERMISSIVE_POLICIES_LIST $POLICY_ARN"
|
|
fi
|
|
|
|
done
|
|
if [[ $PERMISSIVE_POLICIES_LIST ]]; then
|
|
textInfo "STS AssumeRole Policies should only include the complete ARNs for the Roles that the user needs"
|
|
textInfo "Learn more: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_permissions-to-switch.html#roles-usingrole-createpolicy"
|
|
for policy in $PERMISSIVE_POLICIES_LIST; do
|
|
textFail "$REGION: Policy $policy allows permissive STS Role assumption" "$REGION" "$policy"
|
|
done
|
|
else
|
|
textPass "$REGION: No custom policies found that allow permissive STS Role assumption" "$REGION"
|
|
fi
|
|
else
|
|
textPass "$REGION: No custom policies found" "$REGION"
|
|
fi
|
|
}
|