Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fail on iam:PassRole with resource * #147

Closed
atkinsonm opened this issue Jan 7, 2019 · 0 comments · Fixed by #243
Closed

Fail on iam:PassRole with resource * #147

atkinsonm opened this issue Jan 7, 2019 · 0 comments · Fixed by #243
Assignees
@twellspring
Labels
customer Initiated from, or received feedback about from outside Stelligent

Comments

@atkinsonm
Copy link

atkinsonm commented Jan 7, 2019 •
edited
Loading

Cloned from https://gitlab.com/jhctechnology/aws-cloudformation-utilities/awslint/issues/21

iam:PassRole on Resource: "*" can be dangerous because it can allow a user to elevate their own permissions by passing a privileged role to a trusted entity to run commands they could not normally run on their own.

This is an extension of existing cfn_nag rules W11, W12, and W13 to escalate these warnings to failures when a policy contains the iam:PassRole action.
@ghost ghost added the customer Initiated from, or received feedback about from outside Stelligent label May 29, 2019
@twellspring twellspring mentioned this issue Jun 26, 2019
Merged
@twellspring twellspring self-assigned this Jun 28, 2019
twellspring pushed a commit that referenced this issue Jul 2, 2019
#147 wildcard pattern changed to recursive
e4953f6
twellspring pushed a commit that referenced this issue Jul 2, 2019
#147 change class variable to constant
f0eab99
twellspring pushed a commit that referenced this issue Jul 10, 2019
#147 update wildcard_patterns to correctly handle non-string inputs
680a2af
@ghost ghost closed this as completed in #243 Jul 10, 2019
ghost pushed a commit that referenced this issue Jul 10, 2019
#147 Feature/147 (#243)
4e86afe 
* cfn templates created, first rules created

* role rule complete, tests passing

* policy rule complete, tests passing

* All tests pass

* Linted files

* add permutations and more test cases

* base rule for passrole

* Figured out keyword arguments

* #147 wildcard pattern changed to recursive

* #147 change class variable to constant

* #147 update wildcard_patterns to correctly handle non-string inputs
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@twellspring twellspring

Labels
customer Initiated from, or received feedback about from outside Stelligent
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

#147 Feature/147 stelligent/cfn_nag
2 participants
@atkinsonm @twellspring