Project: KICS (Provisioning / Security & Compliance)
File: e8e62026-da63-4904-b402-65adfe3ca975.md

title: Ram Policy Admin Access Not Attached to Users Groups Roles hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: e8e62026-da63-4904-b402-65adfe3ca975 Query name: Ram Policy Admin Access Not Attached to Users Groups Roles Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Ram policies with admin access should not be associated to users, groups or roles<br> ```tf title="Positive test num. 1 - tf file" hl_lines="35" resource "alicloudramuser" "user4" { name = "userName" displayname = "userdisplay_name" mobile = "86-18688888888" email = "hello.uuu@aaa.com" comments = "yoyoyo" force = true } resource "alicloudrampolicy" "policy4" { name = "policyName" document = <<EOF { "Statement": [ { "Action": [ "oss:*" ], "Effect": "Allow", "Resource": [ "acs:oss:::mybucket", "acs:oss:::mybucket/*" ] } ], "Version": "1" } EOF description = "this is a policy test" force = true } resource "alicloudramuserpolicyattachment" "attach" { policyname = alicloudram_policy.policy4.name policytype = alicloudram_policy.policy4.type username = alicloudram_user.user4.name } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="32" resource "alicloudramgroup" "group5" { name = "groupName" comments = "this is a group comments." force = true } resource "alicloudrampolicy" "policy5" { name = "policyName" document = <<EOF { "Statement": [ { "Action": [ "oss:*" ], "Effect": "Allow", "Resource": [ "acs:oss:::mybucket", "acs:oss:::mybucket/*" ] } ], "Version": "1" } EOF description = "this is a policy test" force = true } resource "alicloudramgrouppolicyattachment" "attach" { policyname = alicloudram_policy.policy5.name policytype = alicloudram_policy.policy5.type groupname = alicloudram_group.group5.name } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="49" resource "alicloudramrole" "role6" { name = "roleName" document = <<EOF { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": [ "apigateway.aliyuncs.com", "ecs.aliyuncs.com" ] } } ], "Version": "1" } EOF description = "this is a role

force = true } resource "alicloudrampolicy" "policy6" { name = "policyName" document = <<EOF { "Statement": [ { "Action": [ "oss:*" ], "Effect": "Allow", "Resource": [ "acs:oss:::mybucket", "acs:oss:::mybucket/*" ] } ], "Version": "1" } EOF description = "this is a policy test" force = true } resource "alicloudramrolepolicyattachment" "attach" { policyname = alicloudram_policy.policy6.name policytype = alicloudram_policy.policy6.type rolename = alicloudram_role.role6.name } ``` ```tf title="Negative test num. 1 - tf file" resource "alicloudramuser" "user1" { name = "userName" displayname = "userdisplay_name" mobile = "86-18688888888" email = "hello.uuu@aaa.com" comments = "yoyoyo" force = true } resource "alicloudrampolicy" "policy1" { name = "policyName" document = <<EOF { "Statement": [ { "Action": [ "oss:ListObjects", "oss:GetObject" ], "Effect": "Allow", "Resource": [ "acs:oss:::mybucket", "acs:oss:::mybucket/*" ] } ], "Version": "1" } EOF description = "this is a policy test" force = true } resource "alicloudramuserpolicyattachment" "attach" { policyname = alicloudram_policy.policy1.name policytype = alicloudram_policy.policy1.type username = alicloudram_user.user1.name } ``` ```tf title="Negative test num. 2 - tf file" resource "alicloudramgroup" "group2" { name = "groupName" comments = "this is a group comments." force = true } resource "alicloudrampolicy" "policy2" { name = "policyName" document = <<EOF { "Statement": [ { "Action": [ "oss:ListObjects", "oss:GetObject" ], "Effect": "Allow", "Resource": [ "acs:oss:::mybucket", "acs:oss:::mybucket/*" ] } ], "Version": "1" } EOF description = "this is a policy test" force = true } resource "alicloudramgrouppolicyattachment" "attach" { policyname = alicloudram_policy.policy2.name policytype = alicloudram_policy.policy2.type groupname = alicloudram_group.group2.name } ``` ```tf title="Negative test num. 3 - tf file" resource "alicloudramrole" "role3" { name = "roleName" document = <<EOF { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": [ "apigateway.aliyuncs.com", "ecs.aliyuncs.com" ] } } ], "Version": "1" } EOF description = "this is a role test." force = true } resource "alicloudrampolicy" "policy3" { name = "policyName" document = <<EOF { "Statement": [ { "Action": [ "oss:ListObjects", "oss:GetObject" ], "Effect": "Allow", "Resource": [ "acs:oss:::mybucket", "acs:oss:::mybucket/*" ] } ], "Version": "1" } EOF description = "this is a policy test" force = true } resource "alicloudramrolepolicyattachment" "attach" { policyname = alicloudram_policy.policy3.name policytype = alicloudram_policy.policy3.type rolename = alicloudram_role.role3.name } ```