From b95b3f68d3978abec12e30c858c947c7206ebaee Mon Sep 17 00:00:00 2001
From: Pepe Fagoaga <pepe@verica.io>
Date: Tue, 2 Aug 2022 09:47:04 +0200
Subject: [PATCH] fix(permissions): Include missing appstream:DescribeFleets
 permission  (#1278)

* fix(permissions): AWS AppStream

Include missing appstream:DescribeFleets permission

* fix(permissions): AWS AppStream
---
 iam/create_role_to_assume_cfn.yaml | 12 +++++++-----
 iam/prowler-additions-policy.json  |  1 +
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/iam/create_role_to_assume_cfn.yaml b/iam/create_role_to_assume_cfn.yaml
index 9bf5b0bf43..8a2b5db158 100644
--- a/iam/create_role_to_assume_cfn.yaml
+++ b/iam/create_role_to_assume_cfn.yaml
@@ -7,7 +7,7 @@ AWSTemplateFormatVersion: '2010-09-09'
 #  --stack-name "ProwlerExecRole" \
 #  --parameters "ParameterKey=AuthorisedARN,ParameterValue=arn:aws:iam::123456789012:root"
 #
-Description: | 
+Description: |
   This template creates an AWS IAM Role with an inline policy and two AWS managed policies
   attached. It sets the trust policy on that IAM Role to permit a named ARN in another AWS
   account to assume that role. The role name and the ARN of the trusted user can all be passed
@@ -48,16 +48,18 @@ Resources:
         - 'arn:aws:iam::aws:policy/SecurityAudit'
         - 'arn:aws:iam::aws:policy/job-function/ViewOnlyAccess'
       RoleName: !Sub ${ProwlerRoleName}
-      Policies: 
+      Policies:
         - PolicyName: ProwlerExecRoleAdditionalViewPrivileges
           PolicyDocument:
             Version : '2012-10-17'
             Statement:
             - Effect: Allow
               Action:
-                - 'account:GetContactInformation'
-                - 'account:GetAlternateContact'
-                - 'ds:ListAuthorizedApplications'
+                - 'account:Get*'
+                - 'appstream:DescribeFleets'
+                - 'ds:Get*'
+                - 'ds:Describe*'
+                - 'ds:List*'
                 - 'ec2:GetEbsEncryptionByDefault'
                 - 'ecr:Describe*'
                 - 'elasticfilesystem:DescribeBackupPolicy'
diff --git a/iam/prowler-additions-policy.json b/iam/prowler-additions-policy.json
index 0f74328cea..7a10b1fb0b 100644
--- a/iam/prowler-additions-policy.json
+++ b/iam/prowler-additions-policy.json
@@ -4,6 +4,7 @@
         {
             "Action": [
                 "account:Get*",
+                "appstream:DescribeFleets",
                 "ds:Get*",
                 "ds:Describe*",
                 "ds:List*",