ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 21:11:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(iam): fill resource id with inline policy entity (#5147)

Browse Source 
Co-authored-by: Pedro Martín <pedromarting3@gmail.com>
This commit is contained in:
Prowler Bot
2024-09-23 17:46:25 +02:00
committed by GitHub
parent 4bb2857727
commit a18bc89fe5
8 changed files with 71 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/providers/aws/services/iam/iam_inline_policy_allows_privilege_escalation/iam_inline_policy_allows_privilege_escalation_test.py
+16 -16
View File
@@ -106,9 +106,9 @@ class Test_iam_inline_policy_allows_privilege_escalation:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Inline Policy '{policy_name}' attached to role {role_arn} does not allow privilege escalation."
== f"Inline policy {policy_name} attached to role {role_name} does not allow privilege escalation."
)
assert result[0].resource_id == policy_name
assert result[0].resource_id == f"test_role/{policy_name}"
assert result[0].resource_arn == role_arn
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == []
@@ -162,9 +162,9 @@ class Test_iam_inline_policy_allows_privilege_escalation:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Inline Policy '{policy_name}' attached to user {user_arn} does not allow privilege escalation."
== f"Inline policy {policy_name} attached to user {user_name} does not allow privilege escalation."
)
assert result[0].resource_id == policy_name
assert result[0].resource_id == f"test_user/{policy_name}"
assert result[0].resource_arn == user_arn
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == []
@@ -228,9 +228,9 @@ class Test_iam_inline_policy_allows_privilege_escalation:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Inline Policy '{policy_name}' attached to group {group_arn} does not allow privilege escalation."
== f"Inline policy {policy_name} attached to group {group_name} does not allow privilege escalation."
)
assert result[0].resource_id == policy_name
assert result[0].resource_id == f"test_group/{policy_name}"
assert result[0].resource_arn == group_arn
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == []
@@ -289,13 +289,13 @@ class Test_iam_inline_policy_allows_privilege_escalation:
result = check.execute()
assert len(result) == 1
assert result[0].status == "FAIL"
assert result[0].resource_id == policy_name
assert result[0].resource_id == f"test_role/{policy_name}"
assert result[0].resource_arn == role_arn
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == []
assert search(
f"Inline Policy '{policy_name}' attached to role {role_arn} allows privilege escalation using the following actions: ",
f"Inline policy {policy_name} attached to role {role_name} allows privilege escalation using the following actions: ",
result[0].status_extended,
)
assert search("iam:PassRole", result[0].status_extended)
@@ -348,13 +348,13 @@ class Test_iam_inline_policy_allows_privilege_escalation:
result = check.execute()
assert len(result) == 1
assert result[0].status == "FAIL"
assert result[0].resource_id == policy_name
assert result[0].resource_id == f"test_role/{policy_name}"
assert result[0].resource_arn == role_arn
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == []
assert search(
f"Inline Policy '{policy_name}' attached to role {role_arn} allows privilege escalation using the following actions: ",
f"Inline policy {policy_name} attached to role {role_name} allows privilege escalation using the following actions: ",
result[0].status_extended,
)
assert search("iam:PassRole", result[0].status_extended)
@@ -425,13 +425,13 @@ class Test_iam_inline_policy_allows_privilege_escalation:
result = check.execute()
assert len(result) == 1
assert result[0].status == "FAIL"
assert result[0].resource_id == policy_name
assert result[0].resource_id == f"test_role/{policy_name}"
assert result[0].resource_arn == role_arn
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == []
assert search(
f"Inline Policy '{policy_name}' attached to role {role_arn} allows privilege escalation using the following actions: ",
f"Inline policy {policy_name} attached to role {role_name} allows privilege escalation using the following actions: ",
result[0].status_extended,
)
assert search("iam:PassRole", result[0].status_extended)
@@ -491,13 +491,13 @@ class Test_iam_inline_policy_allows_privilege_escalation:
result = check.execute()
assert len(result) == 1
assert result[0].status == "FAIL"
assert result[0].resource_id == policy_name
assert result[0].resource_id == f"test_role/{policy_name}"
assert result[0].resource_arn == role_arn
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == []
assert search(
f"Inline Policy '{policy_name}' attached to role {role_arn} allows privilege escalation using the following actions: ",
f"Inline policy {policy_name} attached to role {role_name} allows privilege escalation using the following actions: ",
result[0].status_extended,
)
assert search("iam:PassRole", result[0].status_extended)
@@ -551,13 +551,13 @@ class Test_iam_inline_policy_allows_privilege_escalation:
result = check.execute()
assert len(result) == 1
assert result[0].status == "FAIL"
assert result[0].resource_id == policy_name
assert result[0].resource_id == f"test_role/{policy_name}"
assert result[0].resource_arn == role_arn
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == []
assert search(
f"Inline Policy '{policy_name}' attached to role {role_arn} allows privilege escalation using the following actions: ",
f"Inline policy {policy_name} attached to role {role_name} allows privilege escalation using the following actions: ",
result[0].status_extended,
)
tests/providers/aws/services/iam/iam_inline_policy_no_administrative_privileges/iam_inline_policy_no_administrative_privileges_test.py
+12 -12
View File
@@ -103,7 +103,7 @@ class Test_iam_inline_policy_no_administrative_privileges:
assert results[0].status == "FAIL"
assert (
results[0].status_extended
== f"Inline policy {policy_name} attached to group {group_arn} allows '*:*' administrative privileges."
== f"Inline policy {policy_name} attached to group {group_name} allows '*:*' administrative privileges."
)
@mock_aws
@@ -147,7 +147,7 @@ class Test_iam_inline_policy_no_administrative_privileges:
assert results[0].status == "PASS"
assert (
results[0].status_extended
== f"Inline policy {policy_name} attached to group {group_arn} does not allow '*:*' administrative privileges."
== f"Inline policy {policy_name} attached to group {group_name} does not allow '*:*' administrative privileges."
)
@mock_aws
@@ -201,7 +201,7 @@ class Test_iam_inline_policy_no_administrative_privileges:
assert result.status == "FAIL"
assert (
result.status_extended
== f"Inline policy {policy_name_admin} attached to group {group_arn} allows '*:*' administrative privileges."
== f"Inline policy {policy_name_admin} attached to group {group_name} allows '*:*' administrative privileges."
)
elif result.resource_id == policy_name_not_admin:
@@ -212,7 +212,7 @@ class Test_iam_inline_policy_no_administrative_privileges:
assert result.status == "PASS"
assert (
result.status_extended
== f"Inline policy {policy_name_not_admin} attached to group {group_arn} does not allow '*:*' administrative privileges."
== f"Inline policy {policy_name_not_admin} attached to group {group_name} does not allow '*:*' administrative privileges."
)
# Roles
@@ -291,7 +291,7 @@ class Test_iam_inline_policy_no_administrative_privileges:
assert results[0].status == "FAIL"
assert (
results[0].status_extended
== f"Inline policy {policy_name} attached to role {role_arn} allows '*:*' administrative privileges."
== f"Inline policy {policy_name} attached to role {role_name} allows '*:*' administrative privileges."
)
@mock_aws
@@ -338,7 +338,7 @@ class Test_iam_inline_policy_no_administrative_privileges:
assert results[0].status == "PASS"
assert (
results[0].status_extended
== f"Inline policy {policy_name} attached to role {role_arn} does not allow '*:*' administrative privileges."
== f"Inline policy {policy_name} attached to role {role_name} does not allow '*:*' administrative privileges."
)
@mock_aws
@@ -394,7 +394,7 @@ class Test_iam_inline_policy_no_administrative_privileges:
assert result.status == "FAIL"
assert (
result.status_extended
== f"Inline policy {policy_name_admin} attached to group {role_arn} allows '*:*' administrative privileges."
== f"Inline policy {policy_name_admin} attached to group {role_name} allows '*:*' administrative privileges."
)
elif result.resource_id == policy_name_not_admin:
@@ -405,7 +405,7 @@ class Test_iam_inline_policy_no_administrative_privileges:
assert result.status == "PASS"
assert (
result.status_extended
== f"Inline policy {policy_name_not_admin} attached to group {role_arn} does not allow '*:*' administrative privileges."
== f"Inline policy {policy_name_not_admin} attached to group {role_name} does not allow '*:*' administrative privileges."
)
# Users
@@ -484,7 +484,7 @@ class Test_iam_inline_policy_no_administrative_privileges:
assert results[0].status == "FAIL"
assert (
results[0].status_extended
== f"Inline policy {policy_name} attached to user {user_arn} allows '*:*' administrative privileges."
== f"Inline policy {policy_name} attached to user {user_name} allows '*:*' administrative privileges."
)
@mock_aws
@@ -532,7 +532,7 @@ class Test_iam_inline_policy_no_administrative_privileges:
assert results[0].status == "PASS"
assert (
results[0].status_extended
== f"Inline policy {policy_name} attached to user {user_arn} does not allow '*:*' administrative privileges."
== f"Inline policy {policy_name} attached to user {user_name} does not allow '*:*' administrative privileges."
)
@mock_aws
@@ -589,7 +589,7 @@ class Test_iam_inline_policy_no_administrative_privileges:
assert result.status == "FAIL"
assert (
result.status_extended
== f"Inline policy {policy_name_admin} attached to user {user_arn} allows '*:*' administrative privileges."
== f"Inline policy {policy_name_admin} attached to user {user_name} allows '*:*' administrative privileges."
)
elif result.resource_id == policy_name_not_admin:
@@ -600,5 +600,5 @@ class Test_iam_inline_policy_no_administrative_privileges:
assert result.status == "PASS"
assert (
result.status_extended
== f"Inline policy {policy_name_not_admin} attached to user {user_arn} does not allow '*:*' administrative privileges."
== f"Inline policy {policy_name_not_admin} attached to user {user_name} does not allow '*:*' administrative privileges."
)
tests/providers/aws/services/iam/iam_inline_policy_no_full_access_to_cloudtrail/iam_inline_policy_no_full_access_to_cloudtrail_test.py
+10 -10
View File
@@ -54,9 +54,9 @@ class Test_iam_inline_policy_no_full_access_to_cloudtrail:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Inline Policy {policy_name} allows 'cloudtrail:*' privileges to all resources."
== f"Inline policy {policy_name} attached to role {role_name} allows 'cloudtrail:*' privileges to all resources."
)
assert result[0].resource_id == "policy_cloudtrail_full"
assert result[0].resource_id == f"test_role/{policy_name}"
assert result[0].resource_arn == role_arn
assert result[0].region == "eu-west-1"
@@ -101,9 +101,9 @@ class Test_iam_inline_policy_no_full_access_to_cloudtrail:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Inline Policy {policy_name} does not allow 'cloudtrail:*' privileges."
== f"Inline policy {policy_name} attached to role {role_name} does not allow 'cloudtrail:*' privileges."
)
assert result[0].resource_id == "policy_no_cloudtrail_full"
assert result[0].resource_id == f"test_role/{policy_name}"
assert result[0].resource_arn == role_arn
assert result[0].region == "eu-west-1"
@@ -148,9 +148,9 @@ class Test_iam_inline_policy_no_full_access_to_cloudtrail:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Inline Policy {policy_name} allows 'cloudtrail:*' privileges to all resources."
== f"Inline policy {policy_name} attached to role {role_name} allows 'cloudtrail:*' privileges to all resources."
)
assert result[0].resource_id == "policy_cloudtrail_full"
assert result[0].resource_id == f"test_role/{policy_name}"
assert result[0].resource_arn == role_arn
assert result[0].region == "eu-west-1"
@@ -199,9 +199,9 @@ class Test_iam_inline_policy_no_full_access_to_cloudtrail:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Inline Policy {policy_name} does not allow 'cloudtrail:*' privileges."
== f"Inline policy {policy_name} attached to role {role_name} does not allow 'cloudtrail:*' privileges."
)
assert result[0].resource_id == "policy_no_cloudtrail_full"
assert result[0].resource_id == f"test_role/{policy_name}"
assert result[0].resource_arn == role_arn
assert result[0].region == "eu-west-1"
@@ -250,8 +250,8 @@ class Test_iam_inline_policy_no_full_access_to_cloudtrail:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Inline Policy {policy_name} allows 'cloudtrail:*' privileges to all resources."
== f"Inline policy {policy_name} attached to role {role_name} allows 'cloudtrail:*' privileges to all resources."
)
assert result[0].resource_id == "policy_cloudtrail_full"
assert result[0].resource_id == f"test_role/{policy_name}"
assert result[0].resource_arn == role_arn
assert result[0].region == "eu-west-1"
tests/providers/aws/services/iam/iam_inline_policy_no_full_access_to_kms/iam_inline_policy_no_full_access_to_kms_test.py
+10 -10
View File
@@ -54,9 +54,9 @@ class Test_iam_inline_policy_no_full_access_to_kms:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Inline Policy {policy_name} allows 'kms:*' privileges."
== f"Inline policy {policy_name} attached to role {role_name} allows 'kms:*' privileges."
)
assert result[0].resource_id == "policy_kms_full"
assert result[0].resource_id == f"test_role/{policy_name}"
assert result[0].resource_arn == role_arn
assert result[0].region == "eu-west-1"
@@ -101,9 +101,9 @@ class Test_iam_inline_policy_no_full_access_to_kms:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Inline Policy {policy_name} does not allow 'kms:*' privileges."
== f"Inline policy {policy_name} attached to role {role_name} does not allow 'kms:*' privileges."
)
assert result[0].resource_id == "policy_no_kms_full"
assert result[0].resource_id == f"test_role/{policy_name}"
assert result[0].resource_arn == role_arn
assert result[0].region == "eu-west-1"
@@ -148,9 +148,9 @@ class Test_iam_inline_policy_no_full_access_to_kms:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Inline Policy {policy_name} allows 'kms:*' privileges."
== f"Inline policy {policy_name} attached to role {role_name} allows 'kms:*' privileges."
)
assert result[0].resource_id == "policy_kms_full"
assert result[0].resource_id == f"test_role/{policy_name}"
assert result[0].resource_arn == role_arn
assert result[0].region == "eu-west-1"
@@ -199,9 +199,9 @@ class Test_iam_inline_policy_no_full_access_to_kms:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Inline Policy {policy_name} does not allow 'kms:*' privileges."
== f"Inline policy {policy_name} attached to role {role_name} does not allow 'kms:*' privileges."
)
assert result[0].resource_id == "policy_no_kms_full"
assert result[0].resource_id == f"test_role/{policy_name}"
assert result[0].resource_arn == role_arn
assert result[0].region == "eu-west-1"
@@ -250,8 +250,8 @@ class Test_iam_inline_policy_no_full_access_to_kms:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Inline Policy {policy_name} allows 'kms:*' privileges."
== f"Inline policy {policy_name} attached to role {role_name} allows 'kms:*' privileges."
)
assert result[0].resource_id == "policy_kms_full"
assert result[0].resource_id == f"test_role/{policy_name}"
assert result[0].resource_arn == role_arn
assert result[0].region == "eu-west-1"