IAM policies allow exposure of credentials misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_287
Category - Subcategory	IAM - Credential Exposure
Provider	AWS
Severity	HIGH
Framework	Terraform, Terraform Plan

Impact

This rule is used to verify if Identity and Access Management (IAM) policies are configured in a way that prevents the exposure of credentials. This is paramount for security as exposure of credentials could allow unauthorized users access to sensitive resources and operations. This includes viewing, modifying or deleting data, which can expose the organization to a range of risks, from data breaches to the potential shut down of systems. Therefore, it's crucial to ensure IAM policies are correctly configured to prevent credentials exposure.

How to Fix

Resource: aws_iam_policy

• Arguments: policy

To fix this issue, you need to review and ensure that the IAM policies do not allow the exposure of credentials. IAM Policies should enforce the least privileges principle.

The provided Terraform code fixes the identified issue as it strictly follows the least privilege principle, it only provides the resources required permissions to perform "Describe" operations within EC2, and it does not allow any write operations which can possibly change the configuration of the resource leading to potential credentials exposure. [source,go]

resource "aws_iam_policy" "example" { name = "example" path = "/" description = "An example policy"

policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } EOF }

resource "aws_iam_role_policy_attachment" "test-attach" { role = aws_iam_role.test_role.name policy_arn = aws_iam_policy.example.arn }