Excessive privileges - AWS
Description
The application, a user or a role have more privileges than they require. This can be leveraged by an attacker to execute normally restricted actions on a system.
Impact
Execute actions that should be restricted to other groups or roles.
Recommendation
Explicitly assign permissions to the appropriate groups and roles following the principle of least privilege.
Threat
Authenticated attacker from the Internet with access to a misconfigured role.
Expected Remediation Time
⏱️ 30 minutes.
Details
To configure many AWS services, you must pass an IAM role to the service. This allows the service to later assume the role and perform actions on your behalf.
By giving a role or user the iam:PassRole permission, you are saying: > this principal is allowed to assign AWS roles to resources and services in this account.
You can limit which roles a user or service can pass to others by specifying the role ARN(s) in the Resource field of the policy that grants them iam:PassRole:
{ "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:::123456789012:role/SomeRole" "arn:aws:::123456789012:role/OtherRole" ] }...
As a rule of thumb, you should include only the roles required by your application. Wildcards and over-permissive resource grants highly increase the probability of (or completely allow) a privilege escalation.
Requirements
095 - Define users with privileges096 - Set user's required privileges186 - Use the principle of least privilegeRules
Aws Password And Access KeysAws Domain ExposedAws Full Ssm AccessAws Open PassroleAws Endpoints ExposedAws Repository ExposedAws Permissive Role PoliciesAws Log Delivery Write AccessAws Admin Policy AttachedAws Negative StatementTerraform Ssm Full Access LocalsJson Yaml Overpermissive Ssm Wildcard ActionsJson Yaml Excessive Role Policy PrivilegesJson Yaml Secrets Manager PrivilegesTerraform Excessive Role Policy LocalsTerraform Missing Role Based SecurityTerraform Admin Managed Policy AttachedTerraform Ssm Full AccessTerraform Notaction Notresource Policy LocalsTerraform Notaction Notresource PolicyJson Yaml Excessive Admin PrivilegesJson Yaml Notaction Notresource PolicyTerraform Administrator Access AttachedTerraform Excessive Attach PrivilegesJson Yaml User Missing RoleFixes