Ensure no policy is attached that may cause privilege escalation for AWS IAM Role Policy

HIGH

Description

Few actions ('iam:passrole', 'lambda:createfunction', 'lambda:invokefunc*'), will increase the probability of privilege escalation.

Remediation

In AWS Console -

  1. Sign in to the AWS Console and open the IAM Console.
  2. Under Access Management, select Roles.
  3. Choose the role you wish to edit.
  4. Under Permissions policies, expand the policy you wish to edit using the + symbol.
  5. Select Edit and configure the policy accordingly.
  6. Select Review policy, then Save.

In Terraform -

  1. In the aws_iam_role_policy resource, update the assume_role_policy field accordingly.

References:
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy

Policy Details

Rule Reference ID: AC_AWS_0462
CSP: AWS
Remediation Available: Yes
Resource Type: Policy

Frameworks