diff --git a/prowler/providers/aws/lib/arn/arn.py b/prowler/providers/aws/lib/arn/arn.py index 908d2b8d6c..dcf8843dd7 100644 --- a/prowler/providers/aws/lib/arn/arn.py +++ b/prowler/providers/aws/lib/arn/arn.py @@ -46,6 +46,8 @@ def parse_iam_credentials_arn(arn: str) -> ARN: arn_parsed.resource_type != "role" and arn_parsed.resource_type != "user" and arn_parsed.resource_type != "assumed-role" + and arn_parsed.resource_type != "root" + and arn_parsed.resource_type != "federated-user" ): raise RoleArnParsingInvalidResourceType elif arn_parsed.resource == "": diff --git a/tests/providers/aws/lib/arn/arn_test.py b/tests/providers/aws/lib/arn/arn_test.py index cfe26841ef..f45186398e 100644 --- a/tests/providers/aws/lib/arn/arn_test.py +++ b/tests/providers/aws/lib/arn/arn_test.py @@ -245,6 +245,73 @@ class Test_ARN_Parsing: "resource": IAM_ROLE, }, }, + # Root user + { + "input_arn": f"arn:aws:{IAM_SERVICE}::{ACCOUNT_ID}:root", + "expected": { + "partition": COMMERCIAL_PARTITION, + "service": IAM_SERVICE, + "region": None, + "account_id": ACCOUNT_ID, + "resource_type": "root", + "resource": "root", + }, + }, + { + "input_arn": f"arn:{CHINA_PARTITION}:{IAM_SERVICE}::{ACCOUNT_ID}:root", + "expected": { + "partition": CHINA_PARTITION, + "service": IAM_SERVICE, + "region": None, + "account_id": ACCOUNT_ID, + "resource_type": "root", + "resource": "root", + }, + }, + { + "input_arn": f"arn:{GOVCLOUD_PARTITION}:{IAM_SERVICE}::{ACCOUNT_ID}:root", + "expected": { + "partition": GOVCLOUD_PARTITION, + "service": IAM_SERVICE, + "region": None, + "account_id": ACCOUNT_ID, + "resource_type": "root", + "resource": "root", + }, + }, + { + "input_arn": f"arn:aws:sts::{ACCOUNT_ID}:federated-user/Bob", + "expected": { + "partition": COMMERCIAL_PARTITION, + "service": "sts", + "region": None, + "account_id": ACCOUNT_ID, + "resource_type": "federated-user", + "resource": "Bob", + }, + }, + { + "input_arn": f"arn:{CHINA_PARTITION}:sts::{ACCOUNT_ID}:federated-user/Bob", + "expected": { + "partition": CHINA_PARTITION, + "service": "sts", + "region": None, + "account_id": ACCOUNT_ID, + "resource_type": "federated-user", + "resource": "Bob", + }, + }, + { + "input_arn": f"arn:{GOVCLOUD_PARTITION}:sts::{ACCOUNT_ID}:federated-user/Bob", + "expected": { + "partition": GOVCLOUD_PARTITION, + "service": "sts", + "region": None, + "account_id": ACCOUNT_ID, + "resource_type": "federated-user", + "resource": "Bob", + }, + }, ] for test in test_cases: input_arn = test["input_arn"]