Description

Detects IAM policies that allow broad permissions to modify EC2 instance attributes across all AWS resources. This is a security risk as it could enable unauthorized changes to critical EC2 instance configurations like instance types, user data, or security groups without proper restrictions.

Detection Strategy

• Checks IAM policies attached to IAM users, roles, or groups

• Identifies policy statements that have Effect: Allow

• Looks for EC2 instance attribute modification actions (e.g., ModifyInstanceAttribute)

• Verifies if the Resource field is set to '*' (all resources)

• Reports a vulnerability when all these conditions are met, indicating overly permissive EC2 modification rights