Package: iam-validator
IAM Validator for Attribute-based Access Control (ABAC)The module will test IAM policies to ensure they are successful, and also test that a 'negative test' fails.We do both a 'positive test' and a 'negative test' to ensure the policy acts as expected, and allows and denies in
accordance with the policy.Why someone needs this tool:I you have ever deployed IAM policy changes to an organization, you will know you have the potential to break
many users, roles and resources if an incorrect policy is applied.You will do your best to have peer reviews, and check the policies with the IAM validator, but you still have errors
in your policies because the IAM policy simulator does not validate context and conditions correctly.With this tool, you can ensure 100% percent accuracy of your IAM policies, because you are testing against actual
AWS resources.Yes, I say 100% accuracy, because you are testing, actual policies against actual resources.  In addition, your
not just testing to determine if the policy works, but you are also testing to ensure the policy does not work
for someone who does not have the correct attributes.This will give you, and auditors, 100% assurance that users can not get outside their lanes, and perform actions
they do not have permissions to perform.The concept is:Setup creates:Positive testing roleNegative testing role (with different attributes)Developer testing role (for developing and testing conditionals)Has access to S3 Terraform statefile bucketAttach policy you would like to test to this roleValidationAttaches the policies and permissions boundary to the positive and negative testing role, but with different tag
attributes for the negative testing role - which should cause the tests to fail.Destory:Destroys all AWS resources created during setup.How it worksThe policies attached to the developer testing role are attached to the positive and negative testing role.Permissions boundary from developer testing role is put on positive and negative testing role.Tags are copies from developer testing role to positive and negative testing roles, except the attribute is changed for the negative testing role.The user/role assumes the positive testing role and:Passes a comma delimited list of AWS resources associated with the ABAC conditions to terraform moduleA terraform init and terraform apply are executed to create the resources.A terraform destory is executed to demonstrate positive testing role can destroy resources.The user/role assumes the negative testing role and:Passes a comma delimited list of AWS resources associated with the ABAC conditions to terraform moduleA terraform init and terraform apply are executed to create the resources and demonstrate negative testing role is denied creation.A terraform destory is executed to demonstrate testing role can destroy resources.All policies and tags are detached and remove from positive and negative testing roleWhere is the data and config files storedA directory named ~/.iamv is created, and contains a file named config - which contains all the configuration
information.There is also a directory called 'data', which contains all the terraform and module directories.  All terraform
commands are run against this directory.How to run demoThis will:Create an S3 bucket and Dynamodb table for terraform state files and lockingCreate two roles for testing, and one role to test.Example policies and permissions boundary to attach to the role we are testing.Will attached the policies from the role we are testing to the positive and negative testing role.Deploy terraform for the resource we are testing ( example: iam_role)Output the results of the testDestroy the policies, roles, s3 bucket and dynamodb table.iam-validatordemo-riam_roleSetup testing rolesThis will setup the s3 bucket, dynamodb table, and testing roles and policies.iam-validatorsetupValidate an AWS resourceThis will create an AWS resource to test the positive role passes, and the negative role fails.iam-validatorvalidate-riam_roleDestroy all AWS resourcesThis will destory the s3 bucket, dynamodb table, iam testing roles, and iam testing policies.iam-validatordestroyReading the OutputWhen we run validate for resource asg, ec2, eni, security group, ebs volume, and iam_role, we are testing to determine if the positive
testing role can execute these functions, and a negative testing role with different attributes
can not execute these functions.In this example, the positive role had no errors applying and destroying the resources, but the
negative testing role could not create an eni or role.  Thus, the policy is valid.iam-validatorvalidate-reni,iam_role,sg,ebs,ec2,asg{"positive_role":{"apply_errors":[],"destroy_errors":[]},"negative_role":{"apply_errors":["Error: error creating EC2 Network Interface: UnauthorizedOperation: You are not authorized to perform this operation. Encoded authorization failure message: xxxxx","status code: 403, request id: 7d44d5c8-f039-4917-af9e-99d133cec252","","   with module.aws_resources.aws_network_interface.test[0],","   on ../modules/aws_resources/eni.tf line 1, in resource \"aws_network_interface\" \"test\":","    1: resource \"aws_network_interface\" \"test\" {","","","","Error: error creating IAM Role (IAM-Validating-Testing-Role): AccessDenied: User: arn:aws:sts::123456789012:assumed-role/NegativeTestingRole/AssumeRole is not authorized to perform: iam:TagRole on resource: arn:aws:iam::123456789012:role/tset/IAM-Validating-Testing-Role","status code: 403, request id: 2570afa3-beea-4433-a480-a0a9f521f5ba","","   with module.aws_resources.aws_iam_role.role_w_boundary[0],","   on ../modules/aws_resources/iam_role.tf line 1, in resource \"aws_iam_role\" \"role_w_boundary\":","    1: resource \"aws_iam_role\" \"role_w_boundary\" {"," ","Error: Error creating Security Group: UnauthorizedOperation: You are not authorized to perform this operation. Encoded authorization failure message: xxxxx","status code: 403, request id: f4d40057-a5ee-4e9f-9e56-adcc41b1fc65","","Error: Error creating EC2 volume: UnauthorizedOperation: You are not authorized to perform this operation. Encoded authorization failure message: xxxx","status code: 403, request id: 3ba9df31-a8b0-442e-9fb3-c2231e874815","Error: Error launching source instance: UnauthorizedOperation: You are not authorized to perform this operation. Encoded authorization failure message: xxx","status code: 403, request id: 8cdac284-5499-44e3-a2f7-0cb0d0f937e4","Error: Error creating Auto Scaling Group: AccessDenied: User: arn:aws:sts::123456789012:assumed-role/NegativeTestingRole/AssumeRole is not authorized to perform: autoscaling:CreateAutoScalingGroup on resource: arn:aws:autoscaling:us-east-1:123456789012:autoScalingGroup:*:autoScalingGroupName/tset-asg because no identity-based policy allows the autoscaling:CreateAutoScalingGroup action"," \tstatus code: 403, request id: f8cf8336-6233-4615-a7cc-a94864dad5ff",],"destroy_errors":[]}}Removing Orphaned AWS ResourcesSo, what happens if the positive or negative test fails to delete resources?Well, this means that orphaned resources are left in the AWS environment, and will need to be manually destroyed.iam-validatorremove-orphans