Group with privilege escalation by actions 'iam:PutRolePolicy'

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: terraform-aws-group-with-privilege-escalation-by-actions-iam-putrolepolicy

Provider: AWS

Platform: Terraform

Severity: Medium

Category: Access Control

Learn More

Description

This check looks for AWS IAM groups with policies that allow the iam:PutRolePolicy action on all resources ("Resource": "*") in Terraform code. Granting this privilege means members of the group can attach any policy to any IAM role in the account, enabling easy privilege escalation or the creation of backdoors. If left unaddressed, attackers or unprivileged users could use this access to gain administrative permissions or compromise critical resources, leading to severe security risks.

Compliant Code Examples

resource "aws_iam_group" "cosmic2" {
  name = "cosmic2"
}

resource "aws_iam_group_policy" "scoped_inline_policy" {
  name  = "scoped_inline_policy"
  group = aws_iam_group.cosmic2.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "iam:PutRolePolicy",
        ]
        Effect   = "Allow"
        Resource = "arn:aws:iam::123456789012:role/scoped-role"
      },
    ]
  })
}

Non-Compliant Code Examples

resource "aws_iam_group" "cosmic" {
  name = "cosmic"
}

resource "aws_iam_group_policy" "test_inline_policy" {
  name = "test_inline_policy"
  group = aws_iam_group.cosmic.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "iam:PutRolePolicy",
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })
}