ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 04:51:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(aws): add more cases to public IAM resource policies (#5336)

Browse Source
This commit is contained in:
Sergio Garcia
2024-10-11 10:27:23 -04:00
committed by GitHub
parent 493d6a9210
commit 3ace44979a
2 changed files with 39 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/providers/aws/services/iam/lib/policy.py
+6
View File
@@ -187,9 +187,14 @@ def is_policy_public(
or ( # Check if function can be invoked by other AWS services
(
".amazonaws.com" in principal.get("Service", "")
or ".amazon.com" in principal.get("Service", "")
or "*" in principal.get("Service", "")
)
)
and "secretsmanager.amazonaws.com"
not in principal.get(
"Service", ""
) # AWS ensures that resources called by SecretsManager are executed in the same AWS account
)
)
) and (
@@ -276,6 +281,7 @@ def is_condition_block_restrictive(
"aws:sourcearn",
"aws:sourcevpc",
"aws:sourcevpce",
"lambda:eventsourcetoken", # For Alexa Home functions, a token that the invoker must supply.
],
"StringLike": [
"aws:sourceaccount",
tests/providers/aws/services/iam/lib/policy_test.py
+33
View File
@@ -1867,6 +1867,39 @@ class Test_Policy:
}
assert is_policy_public(policy)
def test__is_policy_public_secrets_manager(
self,
):
policy = {
"Statement": [
{
"Sid": "test",
"Effect": "Allow",
"Principal": {"Service": "secretsmanager.amazonaws.com"},
"Action": "lambda:GetFunction",
"Resource": "*",
}
]
}
assert not is_policy_public(policy)
def test__is_policy_public_alexa_condition(
self,
):
policy = {
"Statement": [
{
"Sid": "test",
"Effect": "Allow",
"Principal": {"Service": "alexa-connectedhome.amazon.com"},
"Action": "lambda:GetFunction",
"Resource": "*",
"Condition": {"StringEquals": {"lambda:EventSourceToken": "test"}},
}
]
}
assert not is_policy_public(policy)
def test_check_admin_access(self):
policy = {
"Version": "2012-10-17",