Group with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction'

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: terraform-aws-group-with-privilege-escalation-by-actions-iam-passrole-and-lambda-createfunction-and-lambda-invokefunction

Provider: AWS

Platform: Terraform

Severity: Medium

Category: Access Control

Learn More

Description

This configuration allows an IAM group to escalate privileges by combining lambda:CreateFunction, iam:PassRole, and lambda:InvokeFunction permissions, all with the overly broad Resource = "*". Attackers or unauthorized users with this access can create, invoke, and assign any role to Lambda functions, potentially gaining permissions beyond their intended scope and compromising the entire AWS account. To prevent this, restrict iam:PassRole and Lambda actions to specific, necessary resources and ensure that the policy does not broadly grant privileges, as shown below:

policy = jsonencode({
  Version = "2012-10-17"
  Statement = [
    {
      Action = [
        "ec2:Describe*",
      ]
      Effect   = "Allow"
      Resource = "*"
    },
  ]
})

Compliant Code Examples

# Has lambda:CreateFunction and lambda:InvokeFunction but no iam:PassRole
# grant: only two of the three required permissions are present.
resource "aws_iam_group" "cosmic2" {
  name = "cosmic2"
}

resource "aws_iam_group_policy" "create_and_invoke_only" {
  name  = "create_and_invoke_only"
  group = aws_iam_group.cosmic2.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "lambda:CreateFunction",
          "lambda:InvokeFunction",
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })
}

# Has iam:PassRole and lambda:InvokeFunction but no lambda:CreateFunction
# grant: only two of the three required permissions are present.
resource "aws_iam_group" "cosmic3" {
  name = "cosmic3"
}

resource "aws_iam_group_policy" "pass_role_and_invoke_only" {
  name  = "pass_role_and_invoke_only"
  group = aws_iam_group.cosmic3.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "iam:PassRole",
          "lambda:InvokeFunction",
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })
}

# Has lambda:CreateFunction and iam:PassRole but no lambda:InvokeFunction
# grant: only two of the three required permissions are present.
resource "aws_iam_group" "cosmic4" {
  name = "cosmic4"
}

resource "aws_iam_group_policy" "create_and_pass_role_only" {
  name  = "create_and_pass_role_only"
  group = aws_iam_group.cosmic4.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "lambda:CreateFunction",
          "iam:PassRole",
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })
}

Non-Compliant Code Examples

resource "aws_iam_group" "cosmic" {
  name = "cosmic"
}

resource "aws_iam_group_policy" "test_inline_policy" {
  name = "test_inline_policy"
  group = aws_iam_group.cosmic.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "lambda:CreateFunction",
          "lambda:InvokeFunction"
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })
}


resource "aws_iam_policy_attachment" "test-attach" {
  name       = "test-attachment"
  groups     = [aws_iam_group.cosmic.name]
  policy_arn = aws_iam_policy.policy.arn
}


resource "aws_iam_policy" "policy" {
  name        = "test-policy"
  description = "A test policy"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "iam:PassRole",
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })
}