AWS IAM policy allows all principals used by any AWS service from target account to assume role misc

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_61
Category - Subcategory	IAM - Overly Permissive
Provider	AWS
Severity	HIGH
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

The IAM role is an identity with specific permissions. An IAM role is similar to an IAM user, it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. When a user assumes a role, it provides temporary security credentials for a bounded session. We recommend that you define fine-grained roles for specific services or principles. For example, when settings up an AWS service role it is recommended to include only the permissions required for the service to access the AWS resources required. Alternatively, you can use a Principal as an entity in AWS that can perform actions and access resources. The main benefit of the Principal entity is to limit the use of wildcards in the policy document.

How to Fix

To fix this issue, ensure that the AssumeRolePolicyDocument in the AWS::IAM::Role resource is configured with specific AWS accounts or principals and does not allow assume role permission to any AWS account. [source,go]

Resources: ExecutionRole: Type: AWS::IAM::Role Properties: ... AssumeRolePolicyDocument: ... Statement:

• Effect: "Allow" Principal: AWS:
• • arn:aws:iam::123456789101:root
• • 123456789101

---