aquasecurity / aquasecurity/cloudsploit

Global Cross Account Role Not detected

Open
#908 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
3.8k
Forks
751
Avg merge
11d 9h
Merged PRs (30d)
3

Description

Playing around with cross account possibilities we noticed that if you edit your Trust Role Policy Document to * instead of an accountid Cloudsploit won't trigger an alert running against it

**### This trigger an alert**

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":**{"AWS":"arn:aws:iam::1122334455660:root"}**,"Action":"sts:AssumeRole","Condition":{}}]}

**### This one didn't trigger**

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":**{"AWS":"*"}**,"Action":"sts:AssumeRole","Condition":{}}]}

I believe we could create another check or add principal * into current CrossAccount detection rule.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the two trust role policy examples and locating the existing cross-account detection rule. Done means a wildcard AWS principal triggers an alert while the account-specific principal continues to trigger its existing alert, with regression coverage for both cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, javascript
Domain
authorization, cloud, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.