Remove wilcarded IAM policy in SystemTeskClusterStack
Open
enhancement
- Dominant language
- Java
- Stars
- 107
- Forks
- 29
- Avg merge
- 19h 46m
- Merged PRs (30d)
- 141
Description
Components should follow the principle of least privilege. There is a wildcarded IAM policy in SystemTeskClusterStack:
https://github.com/gchq/sleeper/blob/7be3c46b3b7e511007aef0f207422098368df403/java/system-test/system-test-cdk/src/main/java/sleeper/systemtest/cdk/SystemTestClusterStack.java#L138
This allows the system test tasks to assume more roles than they should be allowed to. It could allow them to ingest data into other instances deployed into the same account.
Contributor guide
Assessment
This issue has not been assessed yet.