[Bug]: AWS privilege escalation false positives

[rieck-srlabs]

Steps to Reproduce

Vanilla AWS setup: I'm running the prowler aws command against a AWS account. The AWS identity has the required policies assigned according to Prowler's documentation.

Expected behavior

Only valid privilege escalation paths be reported by the iam_policy_allows_privilege_escalation rule.

Actual Result with Screenshots or Logs

Prowler reports the following privilege-escalation vector:

Custom Policy arn:aws:iam::*********:policy/********** allows privilege escalation using the following actions: {'cloudformation:CreateStack', 'cloudformation:DescribeStacks'}.

I don't think these two actions suffice for privilege escalation (see also: Context below)

How did you install Prowler?

From pip package (pip install prowler)

Environment Resource

Workstation

OS used

macOS

Prowler version

3.16.0

Pip version

23.3.1

Context

The change introduced with #2655 appears to have incorrectly defined some of the groups. Consider the following code from here

            "PassRole+CloudFormation": {
                "cloudformation:CreateStack",
                "cloudformation:DescribeStacks",
            },

The rule's name suggest that PassRole is required in addition to any cloudformation actions. This aligns with the privilege escalation path 20 highlighted here. However, iam:PassRole is missing in the definition.

A cursory check suggests this problem exists for the following two privilege escalation vectors:

• "PassRole+DataPipeline"
• "PassRole+CloudFormation"