search

mozilla / security

Repository for various tools around security
Mozilla Public License 2.0
42 stars 24 forks source link

Additional permissions needed for security audit role #12

Closed gene1wood closed 5 years ago

gene1wood commented 6 years ago

When attempting to figure out if a Lambda function in a foreign account is the cause of an issue, I found we don't have rights to look at lambda functions are are specifically missing lambda:GetAccountSettings.

Should we have any read permissions in lambda via security auditing roles?

If so what should or shouldn't we have?

cc @andrewkrug

Additionally we should add more permissions with the route53 product as that is also difficult to audit.

gene1wood commented 6 years ago

These can and probably should be expanded to wildcards with prefixs for each of these products

gene1wood commented 6 years ago

Since Security Monkey uses this role, it would be good to review and diff the current permissions : https://github.com/Netflix/security_monkey/blob/develop/docs/iam_aws.md#creating-securitymonkey-role

gene1wood commented 5 years ago

The permissions present in the Security Monkey role that we would be missing after adding the items above are

The permission that is present in the Security Monkey role that we don't want is

gene1wood commented 5 years ago

We should also add