Panther high experimental python

AWS IAM Policy Administrative Privileges

This policy validates that there are no IAM policies that grant full administrative privileges to IAM users or groups.

View Source

Detection Logic

import json

from panther_base_helpers import listify


def policy(resource):
    iam_policy = json.loads(resource["PolicyDocument"])
    statements = listify(iam_policy["Statement"])
    for state in statements:
        actions = listify(state.get("Action", []))
        resources = listify(state.get("Resource", []))
        if state["Effect"] == "Allow" and "*" in actions and "*" in resources:
            return False
    return True

Field Validations

Loading…

Comments (0)

Loading comments...