2

Just wondering about an assessment I'm doing regarding a client's AWS environment. I'm new to AWS to I'm having to learn a lot on the go. I used ScoutSuite and got some findings, specifically:

EC2: 
*Security group whitelists AWS CIDRs*

IAM: 
*Inline group policy allows iam:PassRole *
Inline role policy allows iam:PassRole *
Inline role policy allows sts:AssumeRole *
Managed policy allows iam:PassRole **

The tool doesn't provide any rationale about why these findings are relevant and what they are. Just wondering if anyone has any opinions if these are even findings worth reporting or the rationale behind them.

  • 3
    You should check the documentation. In fact, the results are pretty straightforward. e.g. Security group whitelists AWS CIDR means EC2/RDS/etc services using that security group will allow any network connection inside your VPC CIDR. – mootmoot Mar 19 '19 at 12:58
4

The EC2 findings refers to: AWS Security Group for your EC2 instances have an unknown or too permissive CIDR origin allowed for inbound/outbound traffic. This audit rule expects another Security Group reference as originator or destiny of the traffic that pass through it.

When an unknown CIDR is found, the Unknown CIDR caption is added to the report, which facilitates detection of EC2 security group rules that whitelist network traffic from untrusted IP ranges.

ref-link-1: https://github.com/nccgroup/Scout2/wiki/HowTo:-Use-with-a-list-of-trusted-CIDRs

=========================================================

The IAM findings refers to: IAM Role Policy Too Permissive

  • Inline group policy allows iam:PassRole
  • Inline role policy allows iam:PassRole *
  • Inline role policy allows sts:AssumeRole *

NOTE: You've probably set an IA policy something like the ones show below

"Statement":  [
{
  "Action": [
    "iam:PassRole",
    "iam:AssumeRole"
  ],
  "Effect": "Allow",
  "Resource": [
    "*"
  ]
}
  ] , 
"Version":  "2012-10-17" 
"Statement":  [
{
  "Action": [
    "iam:*"
  ],
  "Effect": "Allow",
  "Resource": [
    "*"
  ]
}
  ] , 
"Version":  "2012-10-17" 

Ensure that the access policies attached to your IAM roles adhere to the principle of least privilege by giving the roles the minimal set of actions required to perform successfully their task.

Providing the right permissions for your IAM roles will significantly reduce the risk of unauthorized access (through API requests) to your AWS resources and services.

PassRole: To pass a role (and its permissions) to an AWS service, a user must have permissions to pass the role to the service. This helps administrators ensure that only approved users can configure a service with a role that grants permissions. To allow a user to pass a role to an AWS service, you must grant the PassRole permission to the user's IAM user, role, or group.

AssumeRole: A trust policy for the role that allows the service to assume the role. For example, you could attach the following trust policy to the role with the UpdateAssumeRolePolicy action. This trust policy allows Amazon EC2 to use the role and the permissions attached to the role.

ref-link-2: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html

AWS Security Audit Open Knowledge bases:

kb-link-1: https://www.cloudconformity.com/conformity-rules/

kb-link-2: https://github.com/cloudsploit/security-remediation-guides

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.