Ensure that there is no wildcard resource in an inline IAM role policy
IAM role policy should be setup in such a way that it follows the least privilege principle. Having wildcard in an resource means that the IAM policy allows specified actions on all resources.
Risk Level: High
Cloud Entity: IAM Role
CloudGuard Rule ID: D9.CFT.IAM.29
Covered by Spectral: No
Category: Security, Identity, & Compliance
GSL LOGIC
AWS_IAM_Role should not have Policies contain-any [ PolicyDocument.Statement contain-any [ Effect='Allow' and Resource='*' ] ]
REMEDIATION
From CFT
Set AWS::IAM::Role Policies.PolicyDocument.Statement.Resource to a restrictive set of resources.
References
- https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html
- https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_resource.html
IAM Role
An IAM role is similar to a user, in that it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it. Also, a role does not have standard long-term credentials (password or access keys) associated with it. Instead, if a user assumes a role, temporary security credentials are created dynamically and provided to the user.
Compliance Frameworks
- AWS CloudFormation ruleset
Updated over 1 year ago