false positive AVD-AWS-0057 for actions that apply only to all resources

[nikpivkin]

Source: https://github.com/aquasecurity/tfsec/issues/1962

There are IAM policy actions that apply only to all resources (*). Quote from AWS documentation:

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action.

Example config:

data "aws_iam_policy_document" "test" {
  statement {
    actions = [
      "logs:ListLogDeliveries",
      "logs:CreateLogDelivery",
      "logs:GetLogDelivery",
      "logs:UpdateLogDelivery",
      "logs:DeleteLogDelivery",
    ]
    resources = [
      "*"
    ]
  }
}

resource "aws_iam_policy" "test" {
  name   = "test"
  policy = data.aws_iam_policy_document.test.json
}

Trivy output:

trivy config .
2023-08-25T15:26:01.677+0700    INFO    Misconfiguration scanning is enabled
2023-08-25T15:26:02.045+0700    INFO    Detected config files: 2

main.tf (terraform)

Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

HIGH: IAM policy document uses sensitive action 'logs:ListLogDeliveries' on wildcarded resource '*'
═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
You should use the principle of least privilege when defining your IAM policies. This means you should specify each exact permission required without using wildcards, as this could cause the granting of access to certain undesired actions, resources and principals.

See https://avd.aquasec.com/misconfig/avd-aws-0057
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 main.tf:10-12
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1   data "aws_iam_policy_document" "test" {
   .   
  10 ┌     resources = [
  11 │       "*"
  12 └     ]
  ..   
  14   }
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

• https://docs.aws.amazon.com/service-authorization/latest/reference/reference_policies_actions-resources-contextkeys.html
• https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchlogs.html#amazoncloudwatchlogs-actions-as-permissions

[nikpivkin]

I have prepared PR in defsec to generate actions, but it doesn't use the API, which may not be reliable.

[simar7]

I have prepared PR in defsec to generate actions, but it doesn't use the API, which may not be reliable.

Is the PR ready? I still see it is marked as draft.

[nikpivkin]

I left comment

[simar7]

Fixed via https://github.com/aquasecurity/trivy/blob/main/magefiles/cloud_actions.go