diff --git a/CHANGELOG.md b/CHANGELOG.md index f5318bad..02c421b5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,8 @@ # CHANGELOG +## 0.0.9 (2020-05-03) +* HTML report now always shows Trust Policies for Roles, even if they do not allow assumption from a Compute Service. This can help assessors with triaging and pentesters for targeting. + ## 0.0.8 (2020-05-03) * Migrated to GitHub actions with automated Homebrew releases diff --git a/cloudsplaining/bin/cloudsplaining b/cloudsplaining/bin/cloudsplaining index 01ea0b42..e7613b23 100755 --- a/cloudsplaining/bin/cloudsplaining +++ b/cloudsplaining/bin/cloudsplaining @@ -7,7 +7,7 @@ """ Cloudsplaining is an AWS IAM Assessment tool that identifies violations of least privilege and generates a risk-prioritized HTML report with a triage worksheet. """ -__version__ = "0.0.8" +__version__ = "0.0.9" import click from cloudsplaining import command diff --git a/cloudsplaining/output/templates/analysis/customer-managed.html b/cloudsplaining/output/templates/analysis/customer-managed.html index 0c177bdf..472ac6b4 100644 --- a/cloudsplaining/output/templates/analysis/customer-managed.html +++ b/cloudsplaining/output/templates/analysis/customer-managed.html @@ -32,7 +32,7 @@ - {% if finding["AssumableByComputeService"]|length > 0 %} + {% if finding["Type"] == "Role" %}
+{
+ "Statement": [
+ {
+ "Action": "sts:AssumeRole",
+ "Effect": "Allow",
+ "Principal": {
+ "Service": "ssm.amazonaws.com"
+ }
+ }
+ ],
+ "Version": "2012-10-17"
+}
+
+
+{
+ "Statement": [
+ {
+ "Action": "sts:AssumeRole",
+ "Effect": "Allow",
+ "Principal": {
+ "Service": "ssm.amazonaws.com"
+ }
+ }
+ ],
+ "Version": "2012-10-17"
+}
+
+