fix(iam): update AWS Support policy (#5402)

Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com>
Co-authored-by: Sergio <sergio@prowler.com>

prowler/providers/aws/services/iam/iam_service.py

@@ -69,7 +69,9 @@ class IAM(AWSService):
         self.__list_attached_role_policies__()
         self.__list_mfa_devices__()
         self.password_policy = self.__get_password_policy__()
-        support_policy_arn = f"arn:{self.audited_partition}:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy"
+        support_policy_arn = (
+            f"arn:{self.audited_partition}:iam::aws:policy/AWSSupportAccess"
+        )
         self.entities_role_attached_to_support_policy = (
             self.__list_entities_role_for_policy__(support_policy_arn)
         )

prowler/providers/aws/services/iam/iam_support_role_created/iam_support_role_created.py

@@ -8,13 +8,17 @@ class iam_support_role_created(Check):
         if iam_client.entities_role_attached_to_support_policy is not None:
             report = Check_Report_AWS(self.metadata())
             report.region = iam_client.region
-            report.resource_id = "AWSSupportServiceRolePolicy"
-            report.resource_arn = f"arn:{iam_client.audited_partition}:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy"
+            report.resource_id = iam_client.audited_account
+            report.resource_arn = (
+                f"arn:{iam_client.audited_partition}:iam::aws:policy/AWSSupportAccess"
+            )
             if iam_client.entities_role_attached_to_support_policy:
                 report.status = "PASS"
-                report.status_extended = f"Support policy attached to role {iam_client.entities_role_attached_to_support_policy[0]['RoleName']}."
+                report.status_extended = f"AWS Support Access policy attached to role {iam_client.entities_role_attached_to_support_policy[0]['RoleName']}."
             else:
                 report.status = "FAIL"
-                report.status_extended = "Support policy is not attached to any role."
+                report.status_extended = (
+                    "AWS Support Access policy is not attached to any role."
+                )
             findings.append(report)
         return findings

tests/providers/aws/services/iam/iam_service_test.py

@@ -33,9 +33,7 @@ ASSUME_ROLE_POLICY_DOCUMENT = {
 
 SECURITY_AUDIT_POLICY_ARN = "arn:aws:iam::aws:policy/SecurityAudit"
 READ_ONLY_ACCESS_POLICY_ARN = "arn:aws:iam::aws:policy/ReadOnlyAccess"
-SUPPORT_SERVICE_ROLE_POLICY_ARN = (
-    "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy"
-)
+SUPPORT_SERVICE_ROLE_POLICY_ARN = "arn:aws:iam::aws:policy/AWSSupportAccess"
 ADMINISTRATOR_ACCESS_POLICY_ARN = "arn:aws:iam::aws:policy/AdministratorAccess"
 
 # Mocking Access Analyzer Calls

tests/providers/aws/services/iam/iam_support_role_created/iam_support_role_created_test.py

@@ -40,7 +40,7 @@ class Test_iam_support_role_created:
         )
         iam.attach_role_policy(
             RoleName=role_name,
-            PolicyArn="arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy",
+            PolicyArn="arn:aws:iam::aws:policy/AWSSupportAccess",
         )
 
         current_audit_info = set_mocked_aws_audit_info([AWS_REGION_US_EAST_1])
@@ -61,14 +61,11 @@ class Test_iam_support_role_created:
             result = check.execute()
             assert result[0].status == "PASS"
             assert search(
-                f"Support policy attached to role {role_name}.",
+                f"AWS Support Access policy attached to role {role_name}.",
                 result[0].status_extended,
             )
-            assert result[0].resource_id == "AWSSupportServiceRolePolicy"
-            assert (
-                result[0].resource_arn
-                == "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy"
-            )
+            assert result[0].resource_id == AWS_ACCOUNT_NUMBER
+            assert result[0].resource_arn == "arn:aws:iam::aws:policy/AWSSupportAccess"
 
     @mock_aws(config={"iam": {"load_aws_managed_policies": True}})
     def test_no_support_role_created(self):
@@ -91,13 +88,10 @@ class Test_iam_support_role_created:
             assert result[0].status == "FAIL"
             assert (
                 result[0].status_extended
-                == "Support policy is not attached to any role."
-            )
-            assert result[0].resource_id == "AWSSupportServiceRolePolicy"
-            assert (
-                result[0].resource_arn
-                == "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy"
+                == "AWS Support Access policy is not attached to any role."
             )
+            assert result[0].resource_id == AWS_ACCOUNT_NUMBER
+            assert result[0].resource_arn == "arn:aws:iam::aws:policy/AWSSupportAccess"
 
     @mock_aws(config={"iam": {"load_aws_managed_policies": True}})
     def test_access_denied(self):