AWS IAM policy documents do not allow * (asterisk) as a statement's action misconfiguration detected

AWS IAM policy documents do not allow * (asterisk) as a statement's action misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_49
Category - Subcategory	IAM - Overly Permissive
Provider	AWS
Severity	HIGH
Framework	Serverless, Terraform, Terraform Plan

Impact

The Action element describes the specific action or actions that will be allowed or denied. Statements must include either an Action or NotAction element. Each AWS service has its own set of actions that describe tasks that can be performed with that service. Specify a value using a namespace that identifies a service, for example, iam, ec2 sqs, sns, s3, followed by the name of the action to be allowed or denied. The name must match an action that is supported by the service. We recommend you do not allow "*" (all resource) statements as part of action elements. This level of access could potentially grant unwanted and unregulated access to anyone given this policy document setting. We recommend you to write a refined policy describing the specific action allowed or required by the specific policy holder.

How to Fix

Arguments: statement

• Attribute: action

Example fix: [source,go]

resource "aws_iam_policy" "example" {

... other configuration ...

policy = <<POLICY { "Version": "2012-10-17", "Statement": { "Effect": "Allow",

• "Action": "", "Resource": "" }

---