diff --git a/prowler/providers/aws/services/iam/iam_service.py b/prowler/providers/aws/services/iam/iam_service.py index 8bfcbd7ced..b32113bce7 100644 --- a/prowler/providers/aws/services/iam/iam_service.py +++ b/prowler/providers/aws/services/iam/iam_service.py @@ -68,7 +68,9 @@ class IAM(AWSService): self._list_attached_role_policies() self._list_mfa_devices() self.password_policy = self._get_password_policy() - support_policy_arn = f"arn:{self.audited_partition}:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy" + support_policy_arn = ( + f"arn:{self.audited_partition}:iam::aws:policy/AWSSupportAccess" + ) self.entities_role_attached_to_support_policy = ( self._list_entities_role_for_policy(support_policy_arn) ) diff --git a/prowler/providers/aws/services/iam/iam_support_role_created/iam_support_role_created.py b/prowler/providers/aws/services/iam/iam_support_role_created/iam_support_role_created.py index 6763f6d354..7354135207 100644 --- a/prowler/providers/aws/services/iam/iam_support_role_created/iam_support_role_created.py +++ b/prowler/providers/aws/services/iam/iam_support_role_created/iam_support_role_created.py @@ -8,13 +8,17 @@ class iam_support_role_created(Check): if iam_client.entities_role_attached_to_support_policy is not None: report = Check_Report_AWS(self.metadata()) report.region = iam_client.region - report.resource_id = "AWSSupportServiceRolePolicy" - report.resource_arn = f"arn:{iam_client.audited_partition}:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy" + report.resource_id = iam_client.audited_account + report.resource_arn = ( + f"arn:{iam_client.audited_partition}:iam::aws:policy/AWSSupportAccess" + ) if iam_client.entities_role_attached_to_support_policy: report.status = "PASS" - report.status_extended = f"Support policy attached to role {iam_client.entities_role_attached_to_support_policy[0]['RoleName']}." + report.status_extended = f"AWS Support Access policy attached to role {iam_client.entities_role_attached_to_support_policy[0]['RoleName']}." else: report.status = "FAIL" - report.status_extended = "Support policy is not attached to any role." + report.status_extended = ( + "AWS Support Access policy is not attached to any role." + ) findings.append(report) return findings diff --git a/tests/providers/aws/services/iam/iam_service_test.py b/tests/providers/aws/services/iam/iam_service_test.py index 6367df390e..35d04c3bac 100644 --- a/tests/providers/aws/services/iam/iam_service_test.py +++ b/tests/providers/aws/services/iam/iam_service_test.py @@ -33,9 +33,7 @@ ASSUME_ROLE_POLICY_DOCUMENT = { SECURITY_AUDIT_POLICY_ARN = "arn:aws:iam::aws:policy/SecurityAudit" READ_ONLY_ACCESS_POLICY_ARN = "arn:aws:iam::aws:policy/ReadOnlyAccess" -SUPPORT_SERVICE_ROLE_POLICY_ARN = ( - "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy" -) +SUPPORT_SERVICE_ROLE_POLICY_ARN = "arn:aws:iam::aws:policy/AWSSupportAccess" ADMINISTRATOR_ACCESS_POLICY_ARN = "arn:aws:iam::aws:policy/AdministratorAccess" # Mocking Access Analyzer Calls diff --git a/tests/providers/aws/services/iam/iam_support_role_created/iam_support_role_created_test.py b/tests/providers/aws/services/iam/iam_support_role_created/iam_support_role_created_test.py index 4809c44414..39ef5a8c41 100644 --- a/tests/providers/aws/services/iam/iam_support_role_created/iam_support_role_created_test.py +++ b/tests/providers/aws/services/iam/iam_support_role_created/iam_support_role_created_test.py @@ -37,7 +37,7 @@ class Test_iam_support_role_created: ) iam.attach_role_policy( RoleName=role_name, - PolicyArn="arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy", + PolicyArn="arn:aws:iam::aws:policy/AWSSupportAccess", ) aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) @@ -58,14 +58,11 @@ class Test_iam_support_role_created: result = check.execute() assert result[0].status == "PASS" assert search( - f"Support policy attached to role {role_name}.", + f"AWS Support Access policy attached to role {role_name}.", result[0].status_extended, ) - assert result[0].resource_id == "AWSSupportServiceRolePolicy" - assert ( - result[0].resource_arn - == "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy" - ) + assert result[0].resource_id == AWS_ACCOUNT_NUMBER + assert result[0].resource_arn == "arn:aws:iam::aws:policy/AWSSupportAccess" @mock_aws(config={"iam": {"load_aws_managed_policies": True}}) def test_no_support_role_created(self): @@ -88,13 +85,10 @@ class Test_iam_support_role_created: assert result[0].status == "FAIL" assert ( result[0].status_extended - == "Support policy is not attached to any role." - ) - assert result[0].resource_id == "AWSSupportServiceRolePolicy" - assert ( - result[0].resource_arn - == "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy" + == "AWS Support Access policy is not attached to any role." ) + assert result[0].resource_id == AWS_ACCOUNT_NUMBER + assert result[0].resource_arn == "arn:aws:iam::aws:policy/AWSSupportAccess" @mock_aws(config={"iam": {"load_aws_managed_policies": True}}) def test_access_denied(self):