AVD-AWS-0057 is detected when AWS IAM conditions are set in policy #6384
Replies: 2 comments 1 reply
-
|
What did you expect to happen differently in this case? |
Beta Was this translation helpful? Give feedback.
-
In this case the policy is being applied to an EC2 instance, typically deployed as a disposable resource (autoscaling, etc) so attempting to use an ARN specific to the resource would be fairly difficult in a dynamic environment. By using conditions I'd expect the scanner to note that the scope is reduced from all EC2 instances to a specific subset and not flag this particular finding. Thanks! |
Beta Was this translation helpful? Give feedback.
-
|
I understand, thanks for explaining. Unfortunately, while your reasoning is correct, the policy still holds true (and has usefulness) for a larger set of cases. You always have the option to ignore the check if you think it is not relevant in your case. |
Beta Was this translation helpful? Give feedback.
-
IDs
AVD-AWS-0057
Description
When you configure conditions in an IAM policy that uses a wildcard in it's resource spec AVD-AWS-0057 is detected.
Reproduction Steps
1. Create a new terraform file with this minimum code example: terraform { required_version = "~> 1.0" required_providers { aws = { source = "hashicorp/aws" version = "~> 5.0" } } } data "aws_iam_policy_document" "this" { statement { effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeTags" ] } statement { effect = "Allow" resources = ["*"] actions = ["ec2:CreateTags"] condition { test = "StringEquals" values = ["true"] variable = "ec2:ResourceTag/CanUpdate" } condition { test = "StringLike" values = ["*"] variable = "aws:RequestTag/TagUpdate" } } } resource "aws_iam_policy" "this" { name = "temp" policy = data.aws_iam_policy_document.this.json } 2. Run trivy code scanTarget
AWS
Scanner
Misconfiguration
Target OS
No response
Debug Output
Beta Was this translation helpful? Give feedback.
All reactions