nuclei-templates/cloud/aws/iam/iam-full-admin-privileges.yaml

52 lines
1.4 KiB
YAML

id: iam-full-admin-privileges
info:
name: Overly Permissive IAM Policies
author: princechaddha
severity: high
description: |
Verifies that no Amazon IAM policies grant full administrative privileges, ensuring adherence to the Principle of Least Privilege
reference:
- https://docs.aws.amazon.com/cli/latest/reference/iam/get-policy-version.html
tags: cloud,devops,aws,amazon,iam,aws-cloud-config
flow: |
code(1)
for(let PolicyName of iterate(template.policies)){
set("policy", PolicyName)
code(2)
}
self-contained: true
code:
- engine:
- sh
- bash
source: |
aws iam list-policies --scope Local --query 'Policies[*].Arn'
extractors:
- type: json # type of the extractor
internal: true
name: policies
json:
- '.[]'
- engine:
- sh
- bash
source: |
aws iam get-policy-version --policy-arn $policy --version-id v1 --query 'PolicyVersion.Document'
matchers:
- type: word
words:
- '"Effect": "Allow"'
- '"Action": "*"'
- '"Resource": "*"'
condition: and
extractors:
- type: dsl
dsl:
- '"The IAM policy " + policy +" is Overly Permissive"'
# digest: 4a0a0047304502203eeeb24dbf1cfd3f41550e0c0b66bfb9ba23ea9912139aa2385e48b3a668d336022100dcb4c90fbb816ab247ea9d506497b900640b3d052bb2ce2b2f8b9a9e7fe58d9e:922c64590222798bb761d5b6d8e72950