From 6dee12450e8b68c0f24fbc8f571c46246134ca03 Mon Sep 17 00:00:00 2001 From: Kay Agahd Date: Fri, 1 Sep 2023 08:36:20 +0100 Subject: [PATCH] [bugfix] check122 has to check not only string but also array values of the Action field (#2796) --- checks/check122 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/checks/check122 b/checks/check122 index 20ecfe5aa6..4a1a02f885 100644 --- a/checks/check122 +++ b/checks/check122 @@ -32,7 +32,7 @@ check122(){ for policy in $LIST_CUSTOM_POLICIES; do POLICY_ARN=$(awk 'BEGIN{FS=OFS=","}{NF--; print}' <<< "${policy}") POLICY_VERSION=$(awk -F ',' '{print $(NF)}' <<< "${policy}") - POLICY_WITH_FULL=$($AWSCLI iam get-policy-version --output text --policy-arn $POLICY_ARN --version-id $POLICY_VERSION --query "[PolicyVersion.Document.Statement] | [] | [?Action!=null] | [?Effect == 'Allow' && Resource == '*' && Action == '*']" $PROFILE_OPT --region $REGION) + POLICY_WITH_FULL=$($AWSCLI iam get-policy-version --output text --policy-arn $POLICY_ARN --version-id $POLICY_VERSION --query "[PolicyVersion.Document.Statement] | [] | [?Action!=null] | [?Effect == 'Allow' && Resource == '*' && contains(Action, '*')]" $PROFILE_OPT --region $REGION) if [[ $POLICY_WITH_FULL ]]; then POLICIES_ALLOW_LIST="$POLICIES_ALLOW_LIST $POLICY_ARN" else