> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-286.md).

# AWS IAM Policy permission may cause privilege escalation misconfiguration detected in code

## Rule Details

|                        |                                      |
| ---------------------- | ------------------------------------ |
| Cortex AppSec Rule ID  | APPSEC\_AWS\_286                     |
| Category - Subcategory | IAM - Overly Permissive              |
| Provider               | AWS                                  |
| Severity               | MEDIUM                               |
| Framework              | Terraform, Terraform Plan            |
| Mapped CSPM/KSPM Rule  | 3d208afd-8254-4649-861b-34e563fbcb7f |

## Impact

Privilege escalation is when a user obtains rights or permissions beyond what they ought to have. If an IAM policy enables privilege escalation, it means that a user or service with lower levels of access could potentially gain higher-level privileges.

For instance, a user with read-only access could exploit vulnerabilities to get administrative access. This is bad because it increases the risk of unintended or malicious activities, potentially leading to data loss, corruption, or unauthorized access. Therefore, it's critical that IAM policies are designed not to allow privilege escalation, thus reducing the possibility of such breaches.

## How to Fix

*Resource:* aws\_iam\_policy

* *Arguments:* policy

To fix this issue, you need to specify the actions which the IAM policy allows explicitly, and avoid using wildcards (\*) which may grant more permissions than necessary.

Also, avoid granting permissions to IAM actions that can change the permissions of IAM roles, as it results in privilege escalation. IAM actions that can cause privilege escalation include: iam:AddUserToGroup, iam:AttachUserPolicy, iam:AttachRolePolicy, iam:AttachGroupPolicy, iam:PutUserPolicy, iam:PutRolePolicy, iam:PutGroupPolicy, etc.

## In this secure Terraform code, the IAM policy explicitly allows only "s3:ListAllMyBuckets" and "s3:GetBucketLocation" actions. It doesn't include IAM actions that could lead to privilege escalation. The resource is also specified, thereby limiting the scope of resources this policy has access to. In addition, there are no wildcards used in the `Action` block, that could potentially allow other undesired permissions. As such, it significantly reduces the risk of privilege escalation and restricts the permissions to only what is necessary. \[source,go]

resource "aws\_iam\_policy" "example" { name = "example" path = "/" description = "A test policy"

## policy = <\<EOF { "Version": "2012-10-17", "Statement": \[ { "Action": \[ "s3:ListAllMyBuckets", "s3:GetBucketLocation" ], "Effect": "Allow", "Resource": "arn:aws:s3:::\*" } ] } EOF }


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-286.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.