aquasecurity / aquasecurity/cloudsploit
Global Cross Account Role Not detected
- Dominant language
- JavaScript
- Stars
- 3.8k
- Forks
- 751
- Avg merge
- 11d 9h
- Merged PRs (30d)
- 3
Description
Playing around with cross account possibilities we noticed that if you edit your Trust Role Policy Document to * instead of an accountid Cloudsploit won't trigger an alert running against it
**### This trigger an alert**
{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":**{"AWS":"arn:aws:iam::1122334455660:root"}**,"Action":"sts:AssumeRole","Condition":{}}]}
**### This one didn't trigger**
{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":**{"AWS":"*"}**,"Action":"sts:AssumeRole","Condition":{}}]}
I believe we could create another check or add principal * into current CrossAccount detection rule.
Contributor guide
Research direction
Start by reproducing the two trust role policy examples and locating the existing cross-account detection rule. Done means a wildcard AWS principal triggers an alert while the account-specific principal continues to trigger its existing alert, with regression coverage for both cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, javascript
- Domain
- authorization, cloud, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100