Project: KICS (Provisioning / Security & Compliance)
File: bcdcbdc6-a350-4855-ae7c-d1e6436f7c97.md

title: IAM Policy Grants 'AssumeRole' Permission Across All Services hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: bcdcbdc6-a350-4855-ae7c-d1e6436f7c97 Query name: IAM Policy Grants 'AssumeRole' Permission Across All Services Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: IAM Policy should not grant 'AssumeRole' permission across all services.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="70 7" // Create a role which OpenShift instances will assume. // This role has a policy saying it can be assumed by ec2 // instances. resource "awsiamrole" "positive1" { name = "${var.nametagprefix}-openshift-instance-role" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Principal": { "Service": "ec2.amazonaws.com", "AWS": "*" }, "Effect": "Allow", "Sid": "" } ] } EOF } // This policy allows an instance to forward logs to CloudWatch, and // create the Log Stream or Log Group if it doesn't exist. resource "awsiampolicy" "positive3" { name = "${var.nametagprefix}-openshift-instance-forward-logs" path = "/" description = "Allows an instance to forward logs to CloudWatch" policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:::*" ] } ] } EOF } // Attach the policies to the role. resource "awsiampolicy_attachment" "positive4" { name = "${var.nametagprefix}-openshift-attachment-forward-logs" roles = ["${awsiamrole.openshift-instance-role.name}"] policyarn = "awsiam_policy.openshift-policy-forward-logs.arn" } // Create a instance profile for the role. resource "awsiaminstance_profile" "positive5" { name = "${var.nametagprefix}-openshift-instance-profile" role = "awsiamrole.openshift-instance-role.name" } resource "awsiamrole" "positive2" { name = "${var.nametagprefix}-openshift-instance-role" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Principal": { "Service": "ec2.amazonaws.com", "AWS": "*" }, "Sid": "" } ] } EOF } ``` ```tf title="Negative test num. 1 - tf file" // Create a role which OpenShift instances will assume. // This role has a policy saying it can be assumed by ec2 // instances. resource "awsiamrole" "negative1" { name = "${var.nametagprefix}-openshift-instance-role" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Principal": { "Service": "ec2.amazonaws.com" }, "Effect": "Allow", "Sid": "" } ] } EOF } // This policy allows an instance to forward logs to CloudWatch, and // create the Log Stream or Log Group if it doesn't exist. resource "awsiampolicy" "negative2" { name = "${var.nametagprefix}-openshift-instance-forward-logs" path = "/" description = "Allows an instance to forward logs to CloudWatch" policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:::*" ] } ] } EOF } // Attach the policies to the role. resource "awsiampolicy_attachment" "negative3" { name = "${var.nametagprefix}-openshift-attachment-forward-logs" roles = ["${awsiamrole.openshift-instance-role.name}"] policyarn = "awsiam_policy.openshift-policy-forward-logs.arn" } // Create a instance profile for the role. resource "awsiaminstance_profile" "negative4" { name = "${var.nametagprefix}-openshift-instance-profile" role = "awsiamrole.openshift-instance-role.name" } ```