ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-23 20:42:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(aws): Corrects privilege escalation vectors (#3823)

Browse Source
This commit is contained in:
Jakob Rieck
2024-04-19 13:42:51 +02:00
committed by GitHub
parent 7a1762be51
commit 326c46defd
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation.py
+3 -1
View File
@@ -57,16 +57,18 @@ class iam_policy_allows_privilege_escalation(Check):
"glue:GetDevEndpoints",
},
"PassRole+CloudFormation": {
"iam:PassRole",
"cloudformation:CreateStack",
"cloudformation:DescribeStacks",
},
"PassRole+DataPipeline": {
"iam:PassRole",
"datapipeline:CreatePipeline",
"datapipeline:PutPipelineDefinition",
"datapipeline:ActivatePipeline",
},
"GlueUpdateDevEndpoint": {"glue:UpdateDevEndpoint"},
"GlueUpdateDevEndpoints": {"glue:UpdateDevEndpoint"},
"GlueUpdateDevEndpoints": {"glue:UpdateDevEndpoints"},
"lambda:UpdateFunctionCode": {"lambda:UpdateFunctionCode"},
"iam:CreateAccessKey": {"iam:CreateAccessKey"},
"iam:CreateLoginProfile": {"iam:CreateLoginProfile"},
tests/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation_test.py
+3 -1
View File
@@ -50,16 +50,18 @@ privilege_escalation_policies_combination = {
"glue:GetDevEndpoints",
},
"PassRole+CloudFormation": {
"iam:PassRole",
"cloudformation:CreateStack",
"cloudformation:DescribeStacks",
},
"PassRole+DataPipeline": {
"iam:PassRole",
"datapipeline:CreatePipeline",
"datapipeline:PutPipelineDefinition",
"datapipeline:ActivatePipeline",
},
"GlueUpdateDevEndpoint": {"glue:UpdateDevEndpoint"},
"GlueUpdateDevEndpoints": {"glue:UpdateDevEndpoint"},
"GlueUpdateDevEndpoints": {"glue:UpdateDevEndpoints"},
"lambda:UpdateFunctionCode": {"lambda:UpdateFunctionCode"},
"iam:CreateAccessKey": {"iam:CreateAccessKey"},
"iam:CreateLoginProfile": {"iam:CreateLoginProfile"},