Group with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole'

Docs > Datadog Security > Code Security > Infrastructure as Code (IaC) Security > IaC Security Rules > Group with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole'

Metadata

Id: terraform-aws-group-with-privilege-escalation-by-actions-iam-passrole-and-ec2-runinstances

Provider: AWS

Platform: Terraform

Severity: Medium

Category: Access Control

Learn More

Provider Reference

Description

Granting an IAM group both the ec2:RunInstances and iam:PassRole permissions with the Resource field set to "*" allows users to launch EC2 instances with any IAM role in the account. This opens a dangerous privilege escalation pathway, as users can assign themselves highly privileged roles by launching instances with those roles attached, effectively bypassing intended access controls. If left unaddressed, this misconfiguration can lead to full account compromise, as attackers could elevate their permissions and gain unauthorized access to sensitive resources.

Compliant Code Examples

# Has ec2:RunInstances but no iam:PassRole grant: only one of the two
# required permissions is present.
resource "aws_iam_group" "cosmic2" {
  name = "cosmic2"
}

resource "aws_iam_group_policy" "run_instances_only" {
  name  = "run_instances_only"
  group = aws_iam_group.cosmic2.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "ec2:RunInstances",
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })
}

# Has iam:PassRole but no ec2:RunInstances grant: only one of the two
# required permissions is present.
resource "aws_iam_group" "cosmic3" {
  name = "cosmic3"
}

resource "aws_iam_group_policy" "pass_role_only" {
  name  = "pass_role_only"
  group = aws_iam_group.cosmic3.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "iam:PassRole",
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })
}

Non-Compliant Code Examples

resource "aws_iam_group" "cosmic" {
  name = "cosmic"
}

resource "aws_iam_group_policy" "test_inline_policy" {
  name = "test_inline_policy"
  group = aws_iam_group.cosmic.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "ec2:RunInstances",
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })
}


resource "aws_iam_policy_attachment" "test-attach" {
  name       = "test-attachment"
  groups     = [aws_iam_group.cosmic.name]
  policy_arn = aws_iam_policy.policy.arn
}


resource "aws_iam_policy" "policy" {
  name        = "test-policy"
  description = "A test policy"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "iam:PassRole",
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })
}