From 326c46defda3d21f08fbaf4a8a637979b7f0f3fc Mon Sep 17 00:00:00 2001
From: Jakob Rieck <135810953+rieck-srlabs@users.noreply.github.com>
Date: Fri, 19 Apr 2024 13:42:51 +0200
Subject: [PATCH] fix(aws): Corrects privilege escalation vectors (#3823)

---
 .../iam_policy_allows_privilege_escalation.py                 | 4 +++-
 .../iam_policy_allows_privilege_escalation_test.py            | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/prowler/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation.py b/prowler/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation.py
index a42d39b1a5..b55eef308c 100644
--- a/prowler/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation.py
+++ b/prowler/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation.py
@@ -57,16 +57,18 @@ class iam_policy_allows_privilege_escalation(Check):
                 "glue:GetDevEndpoints",
             },
             "PassRole+CloudFormation": {
+                "iam:PassRole",
                 "cloudformation:CreateStack",
                 "cloudformation:DescribeStacks",
             },
             "PassRole+DataPipeline": {
+                "iam:PassRole",
                 "datapipeline:CreatePipeline",
                 "datapipeline:PutPipelineDefinition",
                 "datapipeline:ActivatePipeline",
             },
             "GlueUpdateDevEndpoint": {"glue:UpdateDevEndpoint"},
-            "GlueUpdateDevEndpoints": {"glue:UpdateDevEndpoint"},
+            "GlueUpdateDevEndpoints": {"glue:UpdateDevEndpoints"},
             "lambda:UpdateFunctionCode": {"lambda:UpdateFunctionCode"},
             "iam:CreateAccessKey": {"iam:CreateAccessKey"},
             "iam:CreateLoginProfile": {"iam:CreateLoginProfile"},
diff --git a/tests/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation_test.py b/tests/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation_test.py
index e91c54a027..f4578f5be9 100644
--- a/tests/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation_test.py
+++ b/tests/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation_test.py
@@ -50,16 +50,18 @@ privilege_escalation_policies_combination = {
         "glue:GetDevEndpoints",
     },
     "PassRole+CloudFormation": {
+        "iam:PassRole",
         "cloudformation:CreateStack",
         "cloudformation:DescribeStacks",
     },
     "PassRole+DataPipeline": {
+        "iam:PassRole",
         "datapipeline:CreatePipeline",
         "datapipeline:PutPipelineDefinition",
         "datapipeline:ActivatePipeline",
     },
     "GlueUpdateDevEndpoint": {"glue:UpdateDevEndpoint"},
-    "GlueUpdateDevEndpoints": {"glue:UpdateDevEndpoint"},
+    "GlueUpdateDevEndpoints": {"glue:UpdateDevEndpoints"},
     "lambda:UpdateFunctionCode": {"lambda:UpdateFunctionCode"},
     "iam:CreateAccessKey": {"iam:CreateAccessKey"},
     "iam:CreateLoginProfile": {"iam:CreateLoginProfile"},