Data exfiltration allowed without resource constraints misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_108
Category - Subcategory	IAM - Overly Permissive
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

Data Exfiltration actions allow certain read-only IAM actions without resource constraints, such as s3:GetObject, ssm:GetParameter*, or secretsmanager:GetSecretValue.

. Unrestricted s3:GetObject permissions has a long history of customer data leaks. . ssm:GetParameter* and secretsmanager:GetSecretValue are both used to access secrets. . rds:CopyDBSnapshot and rds:CreateDBSnapshot can be used to exfiltrate RDS database contents.

For more information, visit the https://cloudsplaining.readthedocs.io/en/latest/glossary/data-exfiltration/[cloudsplaining documentation.]

How to Fix

Resource: AWS::IAM::ManagedPolicy

• Arguments: Effect + Actions [source,go]

---

Type: 'AWS::IAM::ManagedPolicy' Properties: ... PolicyDocument: ... Statement:

• Effect: Allow Action:
• 's3:GetBucketTagging'
• • 's3:GetObject'
• • 'ssm:GetParameter'
• • 'ssm:GetParameters'
• • 'ssm:GetParametersByPath'
• • 'secretsmanager:GetSecretValue' Resource: '*'

---