Skip to content

Commit

Permalink
fix(iam_inline_policy_no_administrative_privileges): set resource id …
Browse files Browse the repository at this point in the history 
…as the entity name (#2820)
  • Loading branch information
@MrCloudSec
MrCloudSec authored Sep 22, 2023
1 parent 87ddb6b commit 70fbf16
Show file tree
Hide file tree
Showing 4 changed files with 15 additions and 7 deletions.
2 changes: 1 addition & 1 deletion ...ine_policy_no_administrative_privileges/iam_inline_policy_no_administrative_privileges.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ def execute(self) -> Check_Report_AWS:
report = Check_Report_AWS(self.metadata())
report.region = iam_client.region
report.resource_arn = policy.arn
report.resource_id = policy.name
report.resource_id = policy.entity
report.resource_tags = policy.tags
report.status = "PASS"
report.status_extended = f"{policy.type} policy {policy.name} for IAM identity {policy.arn} does not allow '*:*' administrative privileges."
Expand Down
5 changes: 5 additions & 0 deletions prowler/providers/aws/services/iam/iam_service.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -398,6 +398,7 @@ def __list_inline_user_policies__(self):
Policy(
name=policy,
arn=user.arn,
entity=user.name,
type="Inline",
attached=True,
version_id="v1",
Expand Down Expand Up @@ -438,6 +439,7 @@ def __list_inline_group_policies__(self):
Policy(
name=policy,
arn=group.arn,
entity=group.name,
type="Inline",
attached=True,
version_id="v1",
Expand Down Expand Up @@ -478,6 +480,7 @@ def __list_inline_role_policies__(self):
Policy(
name=policy,
arn=role.arn,
entity=role.name,
type="Inline",
attached=True,
version_id="v1",
Expand Down Expand Up @@ -536,6 +539,7 @@ def __list_policies__(self, scope):
Policy(
name=policy["PolicyName"],
arn=policy["Arn"],
entity=policy["PolicyId"],
version_id=policy["DefaultVersionId"],
type="Custom" if scope == "Local" else "AWS",
attached=True
Expand Down Expand Up @@ -714,6 +718,7 @@ class Certificate(BaseModel):
class Policy(BaseModel):
name: str
arn: str
entity: str
version_id: str
type: str
attached: bool
Expand Down
12 changes: 6 additions & 6 deletions ...olicy_no_administrative_privileges/iam_inline_policy_no_administrative_privileges_test.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -128,7 +128,7 @@ def test_groups_admin_inline_policy(self):
assert len(results) == 1
assert results[0].region == AWS_REGION
assert results[0].resource_arn == group_arn
assert results[0].resource_id == policy_name
assert results[0].resource_id == group_name
assert results[0].resource_tags == []
assert results[0].status == "FAIL"
assert (
Expand Down Expand Up @@ -172,7 +172,7 @@ def test_groups_no_admin_inline_policy(self):
assert len(results) == 1
assert results[0].region == AWS_REGION
assert results[0].resource_arn == group_arn
assert results[0].resource_id == policy_name
assert results[0].resource_id == group_name
assert results[0].resource_tags == []
assert results[0].status == "PASS"
assert (
Expand Down Expand Up @@ -316,7 +316,7 @@ def test_roles_admin_inline_policy(self):
assert len(results) == 1
assert results[0].region == AWS_REGION
assert results[0].resource_arn == role_arn
assert results[0].resource_id == policy_name
assert results[0].resource_id == role_name
assert results[0].resource_tags == []
assert results[0].status == "FAIL"
assert (
Expand Down Expand Up @@ -363,7 +363,7 @@ def test_roles_no_admin_inline_policy(self):
assert len(results) == 1
assert results[0].region == AWS_REGION
assert results[0].resource_arn == role_arn
assert results[0].resource_id == policy_name
assert results[0].resource_id == role_name
assert results[0].resource_tags == []
assert results[0].status == "PASS"
assert (
Expand Down Expand Up @@ -507,7 +507,7 @@ def test_users_admin_inline_policy(self):
assert len(results) == 1
assert results[0].region == AWS_REGION
assert results[0].resource_arn == user_arn
assert results[0].resource_id == policy_name
assert results[0].resource_id == user_name
assert results[0].resource_tags == []
assert results[0].status == "FAIL"
assert (
Expand Down Expand Up @@ -553,7 +553,7 @@ def test_users_no_admin_inline_policy(self):
assert len(results) == 1
assert results[0].region == AWS_REGION
assert results[0].resource_arn == user_arn
assert results[0].resource_id == policy_name
assert results[0].resource_id == user_name
assert results[0].resource_tags == []
assert results[0].status == "PASS"
assert (
Expand Down
3 changes: 3 additions & 0 deletions tests/providers/aws/services/iam/iam_service_test.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -818,6 +818,7 @@ def test__list_inline_user_policies__(self):
type="Inline",
attached=True,
document=INLINE_POLICY_NOT_ADMIN,
entity=user_name,
)

# Test IAM Group Inline Policy
Expand Down Expand Up @@ -861,6 +862,7 @@ def test__list_inline_group_policies__(self):
type="Inline",
attached=True,
document=INLINE_POLICY_NOT_ADMIN,
entity=group_name,
)

# Test IAM Role Inline Policy
Expand Down Expand Up @@ -906,4 +908,5 @@ def test__list_inline_role_policies__(self):
type="Inline",
attached=True,
document=INLINE_POLICY_NOT_ADMIN,
entity=role_name,
)

0 comments on commit 70fbf16

Please sign in to comment.