Description

Detects IAM policies in CloudFormation templates that use NotAction with Allow effect, which grants all permissions except those explicitly listed. This is a risky practice that can lead to overly permissive access policies and violate the principle of least privilege.

Detection Strategy

• Review CloudFormation templates containing IAM Role resources

• Check IAM policy statements within the role definitions

• Identify policy statements that combine 'Allow' effect with 'NotAction'

• Report a vulnerability when NotAction is used in an Allow statement since it grants all non-specified permissions

Vulnerable code example

Resources:
  DangerousRole:
    Type: AWS::IAM::Role
    Properties:
      Policies:
        - PolicyName: risky_policy
          PolicyDocument:
            Statement:...

✅ Secure code example

Resources:
  SafeRole:
    Type: AWS::IAM::Role
    Properties:
      Policies:
        - PolicyName: limited_policy
          PolicyDocument:
            Statement:...