Attack paths not reflecting deny statements in IAM

[yruss972]

It seems to me that the attacks algorithm is not taking Deny policies into account when creating paths. I'm not sure how to debug it.

Assuming a policy like:

{
    "Version": "2012-10-17",
    "Statement": [
        {            
           "Effect": "Deny",            
           "Action": [              
                "iam:AttachUserPolicy"
            ],
            "Resource": ["*"]
        },
        {
            "Effect": "Allow",
            "Action": "iam:AttachUserPolicy",
            "Resource": "arn:aws:iam::174522763890:user/${aws:username}"
        }
    ]
}

I still see AttachUserPolicy attack paths coming from a user with that policy after running:

awspx attacks --only-attacks AddUserToGroup AttachUserPolicy CreatePolicyVersion PutUserPolicy --include-conditional-attacks --max-attack-depth 3

Is this a bug? Am I doing something wrong?

[beatro0t]

Hey @yruss972,

You're spot on! Presently, attack computation doesn't consider Deny actions (see https://github.com/FSecureLABS/awspx/wiki/FAQs#why-do-attacks-not-consider-deny-actions)

[yruss972]

Is there anyway to take this into account manually using a query on the graph without respect to attack paths? If so, could you help me with the syntax?

[beatro0t]

Absolutely! You can write your own cypher queries, or construct them visually, using advanced search options (see: https://github.com/FSecureLABS/awspx/wiki/Data-Exploration#advanced-options for more info).

If you opt for cypher, you can start with something like this (assuming you're looking for the actions described by the attacks you listed previously):

MATCH actions=(source)-[:TRANSITIVE*0..]->(policy)-[action:ACTION]->(target)
WHERE action.Name IN ["iam:AddUserToGroup", "iam:AttachUserPolicy", 
                      "iam:CreatePolicyVersion", "iam:PutUserPolicy"
                      ]
    // AND source.Name = "Bob"                  // e.g. filter by a source's name
    // AND target.Name IN ["$User", "$Policy"]  // target will one of these two types so use a collection 
    // AND Action.Effect IN ["Allow", "Deny"]   // these are the only two options to filter an ACTION's Effect on 
RETURN actions

I'd recommend filtering as far as possible because these graphs tend to get really big, really quickly.