ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-23 20:42:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(iam): add exception for public policy in EKS service (#4759)

Browse Source
This commit is contained in:
Rubén De la Torre Vico
2024-11-19 14:42:56 +01:00
committed by GitHub
parent c8fdaa3923
commit e33b081dc6
3 changed files with 32 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/providers/aws/services/iam/iam_role_cross_service_confused_deputy_prevention/iam_role_cross_service_confused_deputy_prevention.metadata.json
+1 -1
View File
@@ -28,5 +28,5 @@
],
"DependsOn": [],
"RelatedTo": [],
"Notes": "CAF Security Epic: IAM"
"Notes": ""
}
prowler/providers/aws/services/iam/lib/policy.py
+15 -10
View File
@@ -168,17 +168,22 @@ def is_policy_public(
in principal.get("CanonicalUser", "")
or check_cross_service_confused_deputy
and (
( # Check if function can be invoked by other AWS services if check_cross_service_confused_deputy is True
(
".amazonaws.com" in principal.get("Service", "")
or ".amazon.com" in principal.get("Service", "")
or "*" in principal.get("Service", "")
)
# Check if function can be invoked by other AWS services if check_cross_service_confused_deputy is True
(
".amazonaws.com" in principal.get("Service", "")
or ".amazon.com" in principal.get("Service", "")
or "*" in principal.get("Service", "")
)
and (
"secretsmanager.amazonaws.com"
not in principal.get(
"Service", ""
) # AWS ensures that resources called by SecretsManager are executed in the same AWS account
or "eks.amazonaws.com"
not in principal.get(
"Service", ""
) # AWS ensures that resources called by EKS are executed in the same AWS account
)
and "secretsmanager.amazonaws.com"
not in principal.get(
"Service", ""
) # AWS ensures that resources called by SecretsManager are executed in the same AWS account
)
)
)
tests/providers/aws/services/iam/lib/policy_test.py
+16
View File
@@ -1923,6 +1923,22 @@ class Test_Policy:
}
assert not is_policy_public(policy, TRUSTED_AWS_ACCOUNT_NUMBER)
def test_is_policy_public_eks(
self,
):
policy = {
"Statement": [
{
"Sid": "test",
"Effect": "Allow",
"Principal": {"Service": "eks.amazonaws.com"},
"Action": "lambda:GetFunction",
"Resource": "*",
}
]
}
assert not is_policy_public(policy, TRUSTED_AWS_ACCOUNT_NUMBER)
def test_is_policy_public_cross_cross_service_confused_deputy(
self,
):