IAM Role With Full Privileges
- Query id: b1ffa705-19a3-4b73-b9d0-0c97d0663842
- Query name: IAM Role With Full Privileges
- Platform: Terraform
- Severity: High
- Category: Access Control
- URL: Github
Description¶
IAM role policy that allow full administrative privileges (for all resources)
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Postitive test num. 1 - tf file
resource "aws_iam_role" "positive1" {
name = "test_role"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": ["*"],
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Effect": "Allow",
"Resource": "*",
"Sid": ""
}
]
}
EOF
tags = {
tag-key = "tag-value"
}
}
resource "aws_iam_role" "positive2" {
name = "test_role2"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "*",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Effect": "Allow",
"Resource": "*",
"Sid": ""
}
]
}
EOF
tags = {
tag-key = "tag-value"
}
}
Code samples without security vulnerabilities¶
Negative test num. 1 - tf file
resource "aws_iam_role" "negative1" {
name = "test_role"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": ["some:action"],
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Effect": "Allow",
"Resource": "*",
"Sid": ""
}
]
}
EOF
tags = {
tag-key = "tag-value"
}
}