AWS IAM Policy permission may cause privilege escalation misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_286
Category - Subcategory	IAM - Overly Permissive
Provider	AWS
Severity	MEDIUM
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	3d208afd-8254-4649-861b-34e563fbcb7f

Impact

Privilege escalation is when a user obtains rights or permissions beyond what they ought to have. If an IAM policy enables privilege escalation, it means that a user or service with lower levels of access could potentially gain higher-level privileges.

For instance, a user with read-only access could exploit vulnerabilities to get administrative access. This is bad because it increases the risk of unintended or malicious activities, potentially leading to data loss, corruption, or unauthorized access. Therefore, it's critical that IAM policies are designed not to allow privilege escalation, thus reducing the possibility of such breaches.

How to Fix

Resource: aws_iam_policy

• Arguments: policy

To fix this issue, you need to specify the actions which the IAM policy allows explicitly, and avoid using wildcards (*) which may grant more permissions than necessary.

Also, avoid granting permissions to IAM actions that can change the permissions of IAM roles, as it results in privilege escalation. IAM actions that can cause privilege escalation include: iam:AddUserToGroup, iam:AttachUserPolicy, iam:AttachRolePolicy, iam:AttachGroupPolicy, iam:PutUserPolicy, iam:PutRolePolicy, iam:PutGroupPolicy, etc.

In this secure Terraform code, the IAM policy explicitly allows only "s3:ListAllMyBuckets" and "s3:GetBucketLocation" actions. It doesn't include IAM actions that could lead to privilege escalation. The resource is also specified, thereby limiting the scope of resources this policy has access to. In addition, there are no wildcards used in the Action block, that could potentially allow other undesired permissions. As such, it significantly reduces the risk of privilege escalation and restricts the permissions to only what is necessary. [source,go]

resource "aws_iam_policy" "example" { name = "example" path = "/" description = "A test policy"

policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:ListAllMyBuckets", "s3:GetBucketLocation" ], "Effect": "Allow", "Resource": "arn:aws:s3:::*" } ] } EOF }