Skip to content

Commit d0f22b1

Browse files
nikpivkinnikpivkin
committed
chore: add removed Go checks as deprecated
Signed-off-by: Nikita Pivkin <[email protected]>
1 parent a6ecb69 commit d0f22b1

20 files changed

+440
-125
lines changed

‎avd_docs/aws/iam/AVD-AWS-0057/CloudFormation.md

+4-5
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,19 @@
11

22
Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
33

4-
```yaml---
4+
```yaml
55
Resources:
66
GoodPolicy:
7-
Type: 'AWS::IAM::Policy'
7+
Type: AWS::IAM::Policy
88
Properties:
99
PolicyName: CFNUsers
1010
PolicyDocument:
1111
Version: "2012-10-17"
1212
Statement:
1313
- Effect: Allow
1414
Action:
15-
- 's3:ListBuckets'
16-
Resource: 'specific-bucket'
17-
15+
- s3:ListBuckets
16+
Resource: specific-bucket
1817
```
1918
2019

‎avd_docs/aws/iam/AVD-AWS-0057/Terraform.md

+34-35
Original file line numberDiff line numberDiff line change
@@ -2,41 +2,40 @@
22
Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
33

44
```hcl
5-
resource "aws_iam_role_policy" "test_policy" {
6-
name = "test_policy"
7-
role = aws_iam_role.test_role.id
8-
9-
policy = data.aws_iam_policy_document.s3_policy.json
10-
}
11-
12-
resource "aws_iam_role" "test_role" {
13-
name = "test_role"
14-
assume_role_policy = jsonencode({
15-
Version = "2012-10-17"
16-
Statement = [
17-
{
18-
Action = "sts:AssumeRole"
19-
Effect = "Allow"
20-
Sid = ""
21-
Principal = {
22-
Service = "s3.amazonaws.com"
23-
}
24-
},
25-
]
26-
})
27-
}
28-
29-
data "aws_iam_policy_document" "s3_policy" {
30-
statement {
31-
principals {
32-
type = "AWS"
33-
identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
34-
}
35-
actions = ["s3:GetObject"]
36-
resources = [aws_s3_bucket.example.arn]
37-
}
38-
}
39-
5+
resource "aws_iam_role_policy" "test_policy" {
6+
name = "test_policy"
7+
role = aws_iam_role.test_role.id
8+
9+
policy = data.aws_iam_policy_document.s3_policy.json
10+
}
11+
12+
resource "aws_iam_role" "test_role" {
13+
name = "test_role"
14+
assume_role_policy = jsonencode({
15+
Version = "2012-10-17"
16+
Statement = [
17+
{
18+
Action = "sts:AssumeRole"
19+
Effect = "Allow"
20+
Sid = ""
21+
Principal = {
22+
Service = "s3.amazonaws.com"
23+
}
24+
},
25+
]
26+
})
27+
}
28+
29+
data "aws_iam_policy_document" "s3_policy" {
30+
statement {
31+
principals {
32+
type = "AWS"
33+
identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
34+
}
35+
actions = ["s3:GetObject"]
36+
resources = [aws_s3_bucket.example.arn]
37+
}
38+
}
4039
```
4140

4241
#### Remediation Links

‎avd_docs/aws/iam/AVD-AWS-0057/docs.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11

22
You should use the principle of least privilege when defining your IAM policies. This means you should specify each exact permission required without using wildcards, as this could cause the granting of access to certain undesired actions, resources and principals.
33

4+
45
### Impact
5-
Overly permissive policies may grant access to sensitive resources
6+
<!-- Add Impact here -->
67

78
<!-- DO NOT CHANGE -->
89
{{ remediationActions }}

‎avd_docs/aws/iam/AVD-AWS-0169/docs.md

+2-3
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,10 @@
11

2-
32
By implementing least privilege for access control, an IAM Role will require an appropriate
43
IAM Policy to allow Support Center Access in order to manage Incidents with AWS Support.
5-
4+
65

76
### Impact
8-
Incident management is not possible without a support role.
7+
<!-- Add Impact here -->
98

109
<!-- DO NOT CHANGE -->
1110
{{ remediationActions }}

‎avd_docs/aws/sam/AVD-AWS-0114/CloudFormation.md

+11-12
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

22
Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
33

4-
```yaml---
4+
```yaml
55
Resources:
66
GoodFunction:
77
Type: AWS::Serverless::Function
@@ -10,20 +10,19 @@ Resources:
1010
ImageUri: account-id.dkr.ecr.region.amazonaws.com/ecr-repo-name:image-name
1111
ImageConfig:
1212
Command:
13-
- "app.lambda_handler"
13+
- app.lambda_handler
1414
EntryPoint:
15-
- "entrypoint1"
16-
WorkingDirectory: "workDir"
17-
Policies:
15+
- entrypoint1
16+
WorkingDirectory: workDir
17+
Policies:
1818
- AWSLambdaExecute
19-
- Version: '2012-10-17'
19+
- Version: "2012-10-17"
2020
Statement:
21-
- Effect: Allow
22-
Action:
23-
- s3:GetObject
24-
- s3:GetObjectACL
25-
Resource: 'arn:aws:s3:::my-bucket/*'
26-
21+
- Effect: Allow
22+
Action:
23+
- s3:GetObject
24+
- s3:GetObjectACL
25+
Resource: arn:aws:s3:::my-bucket/*
2726
```
2827
2928

‎avd_docs/aws/sam/AVD-AWS-0114/docs.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11

22
You should use the principle of least privilege when defining your IAM policies. This means you should specify each exact permission required without using wildcards, as this could cause the granting of access to certain undesired actions, resources and principals.
33

4+
45
### Impact
5-
Overly permissive policies may grant access to sensitive resources
6+
<!-- Add Impact here -->
67

78
<!-- DO NOT CHANGE -->
89
{{ remediationActions }}

‎avd_docs/aws/sam/AVD-AWS-0120/CloudFormation.md

+8-9
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

22
Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
33

4-
```yaml---
4+
```yaml
55
Resources:
66
GoodFunction:
77
Type: AWS::Serverless::StateMachine
@@ -16,16 +16,15 @@ Resources:
1616
Role: arn:aws:iam::123456123456:role/service-role/my-sample-role
1717
Tracing:
1818
Enabled: true
19-
Policies:
19+
Policies:
2020
- AWSLambdaExecute
21-
- Version: '2012-10-17'
21+
- Version: "2012-10-17"
2222
Statement:
23-
- Effect: Allow
24-
Action:
25-
- s3:GetObject
26-
- s3:GetObjectACL
27-
Resource: 'arn:aws:s3:::my-bucket/*'
28-
23+
- Effect: Allow
24+
Action:
25+
- s3:GetObject
26+
- s3:GetObjectACL
27+
Resource: arn:aws:s3:::my-bucket/*
2928
```
3029
3130

‎avd_docs/aws/sam/AVD-AWS-0120/docs.md

+4-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11

2-
You should use the principle of least privilege when defining your IAM policies. This means you should specify each exact permission required without using wildcards, as this could cause the granting of access to certain undesired actions, resources and principals.
2+
You should use the principle of least privilege when defining your IAM policies.
3+
This means you should specify each exact permission required without using wildcards, as this could cause the granting of access to certain undesired actions, resources and principals.
4+
35

46
### Impact
5-
Overly permissive policies may grant access to sensitive resources
7+
<!-- Add Impact here -->
68

79
<!-- DO NOT CHANGE -->
810
{{ remediationActions }}

‎avd_docs/aws/ssm/AVD-AWS-0134/Terraform.md

+2-4
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,10 @@ Remove this potential exfiltration HTTP request.
33

44
```hcl
55
resource "aws_ssm_parameter" "db_password" {
6-
name = "db_password"
7-
type = "SecureString"
6+
name = "db_password"
7+
type = "SecureString"
88
value = var.db_password
99
}
10-
11-
1210
```
1311

1412

‎avd_docs/aws/ssm/AVD-AWS-0134/docs.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11

22
The data.http block can be used to send secret data outside of the organisation.
33

4+
45
### Impact
5-
Secrets could be exposed outside of the organisation.
6+
<!-- Add Impact here -->
67

78
<!-- DO NOT CHANGE -->
89
{{ remediationActions }}

‎checks/cloud/aws/accessanalyzer/enable_access_analyzer.rego

+1
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
# service: accessanalyzer
2121
# severity: LOW
2222
# short_code: enable-access-analyzer
23+
# deprecated: true
2324
# recommended_action: Enable IAM Access analyzer across all regions.
2425
# frameworks:
2526
# cis-aws-1.4:

‎checks/cloud/aws/iam/no_policy_wildcards.rego

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# METADATA
2+
# title: IAM policy should avoid use of wildcards and instead apply the principle of least privilege
3+
# description: |
4+
# You should use the principle of least privilege when defining your IAM policies. This means you should specify each exact permission required without using wildcards, as this could cause the granting of access to certain undesired actions, resources and principals.
5+
# scope: package
6+
# schemas:
7+
# - input: schema["cloud"]
8+
# related_resources:
9+
# - https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html
10+
# custom:
11+
# id: AVD-AWS-0057
12+
# avd_id: AVD-AWS-0057
13+
# provider: aws
14+
# service: iam
15+
# severity: HIGH
16+
# short_code: no-policy-wildcards
17+
# deprecated: true
18+
# recommended_action: Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
19+
# frameworks:
20+
# default:
21+
# - null
22+
# cis-aws-1.4:
23+
# - "1.16"
24+
# input:
25+
# selector:
26+
# - type: cloud
27+
# subtypes:
28+
# - service: iam
29+
# provider: aws
30+
# terraform:
31+
# links:
32+
# - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document
33+
# good_examples: checks/cloud/aws/iam/no_policy_wildcards.yaml
34+
# bad_examples: checks/cloud/aws/iam/no_policy_wildcards.yaml
35+
# cloudformation:
36+
# good_examples: checks/cloud/aws/iam/no_policy_wildcards.yaml
37+
# bad_examples: checks/cloud/aws/iam/no_policy_wildcards.yaml
38+
package builtin.aws.iam.aws0057

0 commit comments

Comments
 (0)