IAM policy parser reporting incorrectly if multiple SID's in policy

[mjseid]

Description :
I am testing the "Reject if the role can be assumed by ANY role in ANY account" example given on your website. My test policy contains multiple SIDs, one with sts:AssumeRole to a specific arn and one with other permissions to *. The scenario fails even though the SID with the assume role permission is restricted.

To Reproduce

1. <Either a sample terraform code, or your terraform plan file if it doesn't have any confidential information>

resource "aws_iam_policy" "assumeany-policy" {
  name        = "assumeany-policy"
  path        = "/"
  description = "test policy"

  policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "logs:PutLogEvents",
                "logs:DescribeLogStreams",
                "logs:CreateLogStream",
                "logs:CreateLogGroup",
                "lambda:InvokeFunction"
            ],
            "Resource": "*"
        },
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::123456583231:role/cross-role"
        }
    ]
}
EOF
}

2. default parameters
3. python package

    Scenario: Reject if a policy can assume ANY role in ANY account
        Given I have aws_iam_policy defined
        When it contains policy
        And it contains Statement
        And its Effect is Allow
        And its Action is sts:AssumeRole
        And it contains resource
        Then its value must not match the "\*" regex
          Failure: resource property in aws_iam_policy.assumeany-policy resource matches with \* regex. It is set to *.

5. <Your feature/scenario/steps>

  Scenario: Reject if a policy can assume ANY role in ANY account
      Given I have aws_iam_policy defined
      When it contains policy
      And it contains Statement
      And its Effect is Allow
      And its Action is sts:AssumeRole
      And it contains resource
      Then its value must not match the "\*" regex

Expected behavior :
I expect the scenario to pass since the assumerole permission is restricted.

Tested versions :

• <terraform-compliance version (1.0.54)>
• <terraform version (0.12.12)>
• <python runtime version, if running as a python package (3.7.3)>

[eerkunt]

Found the problem. It is due to failure of resource filtering on And its Action is sts:AssumeRole because it is trying to filter out of a list of list of lists.

Having a deeper look, this might take some time to fix.

[eerkunt]

Hi @mjseid,

Can you have a try with 1.0.55 version please ? Thanks al lot!

[mjseid]

yes, works as expected now. thank you