Project: KICS (Provisioning / Security & Compliance)
File: 12b7e704-37f0-4d1e-911a-44bf60c48c21.md

title: IAM Role Allows All Principals To Assume hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 12b7e704-37f0-4d1e-911a-44bf60c48c21 Query name: IAM Role Allows All Principals To Assume Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: IAM role allows all services or principals to assume it<br> ```tf title="Positive test num. 1 - tf file" hl_lines="37" // Create a role which OpenShift instances will assume. // This role has a policy saying it can be assumed by ec2 // instances. resource "awsiamrole" "positive1" { name = "${var.nametagprefix}-openshift-instance-role" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Principal": { "Service": "ec2.amazonaws.com" }, "Effect": "Allow", "Sid": "" } ] } EOF } // This policy allows an instance to forward logs to CloudWatch, and // create the Log Stream or Log Group if it doesn't exist. resource "awsiamrole" "positive2" { name = "${var.nametagprefix}-openshift-instance-forward-logs" path = "/" description = "Allows an instance to forward logs to CloudWatch" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Principal": { "AWS": "arn:aws:iam::root" }, "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:iam::::*" ] } ] } EOF } // Attach the policies to the role. resource "awsiampolicy_attachment" "positive3" { name = "${var.nametagprefix}-openshift-attachment-forward-logs" roles = ["${awsiamrole.openshift-instance-role.name}"] policyarn = "${awsiam_policy.openshift-policy-forward-logs.arn}" } // Create a instance profile for the role. resource "awsiaminstance_profile" "positive4" { name = "${var.nametagprefix}-openshift-instance-profile" role = "${awsiamrole.openshift-instance-role.name}" } ``` ```tf title="Negative test num. 1 - tf file" // Create a role which OpenShift instances will assume. // This role has a policy saying it can be assumed by ec2 // instances. resource "awsiamrole" "negative1" { name = "${var.nametagprefix}-openshift-instance-role" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Principal": { "Service": "ec2.amazonaws.com" }, "Effect": "Allow", "Sid": "" } ] } EOF } // This policy allows an instance to forward logs to CloudWatch, and // create the Log Stream or Log Group if it doesn't exist. resource "awsiampolicy" "negative2" { name = "${var.nametagprefix}-openshift-instance-forward-logs" path = "/" description = "Allows an instance to forward logs to CloudWatch" policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Principal": { "AWS": "arn:aws:iam::some_role" }, "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:iam::::*" ] } ] } EOF } // Attach the policies to the role. resource "awsiampolicy_attachment" "negative3" { name = "${var.nametagprefix}-openshift-attachment-forward-logs" roles = ["${awsiamrole.openshift-instance-role.name}"] policyarn = "${awsiam_policy.openshift-policy-forward-logs.arn}" } // Create a instance profile for the role. resource "awsiaminstance_profile" "negative4" { name = "${var.nametagprefix}-openshift-instance-profile" role = "${awsiamrole.openshift-instance-role.name}" } ```