Since #243, any AWS::IAM::Role, AWS::IAM::Policy, or AWS::IAM::ManagedPolicy is flagged as an error if it has statements affecting Action: iam:PassRole on Resource: *, no matter the effect of the statements. Denying can only harden security, and the error descriptions indicate that the rules were meant to report when the action is allowed ("should not allow"), so I propose to amend these rules to only consider statements with Effect: Allow.
------------------------------------------------------------
.\template.false-positive-allow-passrole-wildcard.yaml
------------------------------------------------------------------------------------------------------------------------
| FAIL F40
|
| Resource: ["ManagedPolicyFalsePositive"]
| Line Numbers: [38]
|
| IAM managed policy should not allow a * resource with PassRole action
------------------------------------------------------------
| FAIL F39
|
| Resource: ["PolicyFalsePositive"]
| Line Numbers: [26]
|
| IAM policy should not allow * resource with PassRole action
------------------------------------------------------------
| FAIL F38
|
| Resource: ["RoleFalsePositive"]
| Line Numbers: [8]
|
| IAM role should not allow * resource with PassRole action on its permissions policy
Failures count: 3
Warnings count: 0
@denenr , thanks for reporting and including these details. I agree with the evaluation that the PassRole related rules should not trigger for Deny statements and we'll get this updated!
Since #243, any
AWS::IAM::Role
,AWS::IAM::Policy
, orAWS::IAM::ManagedPolicy
is flagged as an error if it has statements affectingAction: iam:PassRole
onResource: *
, no matter the effect of the statements. Denying can only harden security, and the error descriptions indicate that the rules were meant to report when the action is allowed ("should not allow"
), so I propose to amend these rules to only consider statements withEffect: Allow
.Given the following template:
cfn_nag
reports the following:Affected lines of code:
Those lines are identical (not considering indentation). Prefixing them with
statement.effect == 'Allow' &&
would be enough: