Panther medium experimental python

AWS IAM Role Restricts Usage

This policy validates that IAM roles in the account are restrictive in what entities may assume them. This can help prevent malicious actors from assuming roles they should not be assuming.

View Source

Detection Logic

import json

from policyuniverse.policy import Policy

BAD_PRINCIPALS = {
    "*",
}


def policy(resource):
    if resource["AssumeRolePolicyDocument"] is None:
        return True

    iam_policy = Policy(json.loads(resource["AssumeRolePolicyDocument"]))

    for statement in iam_policy.statements:
        # Only apply to allow effects
        if statement.effect != "Allow":
            continue

        # Don't apply where there are strong conditions
        if statement.condition_entries:
            continue

        if BAD_PRINCIPALS.intersection(statement.principals):
            return False

    return True

Field Validations

Loading…

Comments (0)

Loading comments...