> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-109.md).

# Resource exposure allows modification of policies and exposes resources misconfiguration detected in

## Rule Details

|                        |                                                       |
| ---------------------- | ----------------------------------------------------- |
| Cortex AppSec Rule ID  | APPSEC\_AWS\_109                                      |
| Category - Subcategory | IAM - Overly Permissive                               |
| Provider               | AWS                                                   |
| Severity               | LOW                                                   |
| Framework              | CloudFormation, Serverless, Terraform, Terraform Plan |

## Impact

This rule allows actions that permit modification of resource-based policies or can otherwise can expose AWS resources to the public via similar actions that can lead to resource exposure.

For example:

. s3:PutBucketPolicy, s3:PutBucketAcl, and s3:PutObjectAcl grant permissions to modify the properties of S3 buckets or objects for new or existing objects in an S3 bucket, which could expose objects to rogue actors or to the internet. . ecr:SetRepositoryPolicy could allow an attacker to exfiltrate container images (which sometimes unintentionally contain secrets and non-public information), tamper with container images, or otherwise modify. . iam:UpdateAssumeRolePolicy could allow an attacker to create a backdoor by assuming a privileged role in the victim account from an external account.

The ability to modify AWS Resource Access Manager, which could allow a malicious actor to share a VPC hosting sensitive or internal services to rogue AWS accounts Attackers can easily exploit Resource Exposure permissions to expose resources to rogue users or the internet, as shown by endgame, an AWS pentesting tool that was also released by Salesforce.

For more info, visit <https://cloudsplaining.readthedocs.io/en/latest/glossary/resource-exposure/\\[cloudsplaning> documentation.]

## How to Fix

*Resource:* aws\_iam\_policy\_document

* *Arguments:* effect + actions \[source,go]

***

Type: 'AWS::IAM::ManagedPolicy' Properties: ... PolicyDocument: ... Statement:

* Effect: Allow Action:
* 's3:\*' Resource: 'foo'

***


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-109.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.