Panther medium experimental python

AWS IAM User Not In Conflicting Groups

This policy validates that IAM users are not in IAM groups that are considered mutually exclusive. For example, in some workflows developers are responsible for dev environments and sysadmins are responsible for prod environments. In this situation no (or very few) users should be in both sysadmin and developer groups. This is in following with the principle of least privilege.

View Source

Detection Logic

# This policy ensures that users do not belong to groups that should be exclusive.
# A common example would be the Developer group and the Production admin group, as in tightly
# controlled environments developers should not be able to deploy to production directly and
# sysadmins should not have access to developmental source code.
#
# GROUP_CONFLICTS is formatted as a list of sets. Each inner set contains mutually exclusive groups.
GROUP_CONFLICTS = [
    {"PROD_ADMIN", "DEV"},
]


def policy(resource):
    group_names = {group["GroupName"] for group in resource["Groups"] or []}

    # If the user is in more than one group in a mutually exclusive set, return False
    for conflict_set in GROUP_CONFLICTS:
        if len(group_names.intersection(conflict_set)) > 1:
            return False

    return True

Field Validations

Loading…

Comments (0)

Loading comments...