Robertoriv feature/check assume role from unknown

[scriptsrc]

This PR extends #478.

It adds minor fixes. @robertoriv - Could you review my changes?

I had to remove one of the self.i_am_singular lines and replace it with a hardcoded "IAM Role" because the nested method definitions could not access self. (Scope issue?)

I'll try to merge this by Tuesday.

[coveralls]

Coverage decreased (-0.2%) to 51.386% when pulling 4e4fd6a on robertoriv-feature/check_assume_role_from_unknown into 198ed04 on develop.

[robertoriv]

@MonkeySecurity, ran some quick tests.

2017-01-03 11:28:14,065 DEBUG: Saving NEW issue IAMRoleAuditor -- IAM Role allows assume-role from an Unknown Account (<first_test_account>) -- {"Action": "sts:AssumeRole", "Sid": "", "Effect": "Allow", "Principal": {"AWS": ["*", "arn:aws:iam::<first_test_account>:root", "arn:aws:iam::<second_test_account>:root"]}} -- 10 -- [] ...
2017-01-03 11:28:14,066 DEBUG: Saving NEW issue IAMRoleAuditor -- IAM Role allows assume-role from an Unknown Account (<second_test_account>) -- {"Action": "sts:AssumeRole", "Sid": "", "Effect": "Allow", "Principal": {"AWS": ["*", "arn:aws:iam::<first_test_account>:root", "arn:aws:iam::<second_test_account>:root"]}} -- 10 -- [] ...
2017-01-03 11:28:14,066 DEBUG: Saving NEW issue IAMRoleAuditor -- IAM Role has iam:PassRole privileges. -- {"Action": ["iam:PassRole"], "Resource": ["*"], "Effect": "Allow", "Sid": "Stmt1483463973000"} -- 9 -- [] ...
2017-01-03 11:28:14,066 DEBUG: Saving NEW issue IAMRoleAuditor -- IAM Role has IAM privileges. -- {"Action": ["iam:AddUserToGroup"], "Resource": ["*"], "Effect": "Allow", "Sid": "Stmt1483463935000"} -- 9 -- [] ...
2017-01-03 11:28:14,066 DEBUG: Saving NEW issue IAMRoleAuditor -- IAM Role has full IAM privileges. -- {"Action": ["iam:*"], "Resource": ["*"], "Effect": "Allow", "Sid": "Stmt1483463880000"} -- 10 -- [] ...
2017-01-03 11:28:14,066 DEBUG: Saving NEW issue IAMRoleAuditor -- IAM Role contains NotAction. -- "iam:*" -- 10 -- [] ...
2017-01-03 11:28:14,066 DEBUG: Saving NEW issue IAMRoleAuditor -- IAM Role can change security groups. -- ec2:AuthorizeSecurityGroupIngress -- 7 -- [] ...
2017-01-03 11:28:14,067 DEBUG: Saving NEW issue IAMRoleAuditor -- IAM Role allows assume-role from anyone -- {"Action": "sts:AssumeRole", "Sid": "", "Effect": "Allow", "Principal": {"AWS": ["*", "arn:aws:iam::<first_test_account>:root", "arn:aws:iam::<second_test_account>:root"]}} -- 10 -- [] ...

👍 LGTM