add rules for aws_iam_role

stelligent · Nov 4, 2018 · 6c3f6d2 · 6c3f6d2
1 parent 922dc0e
commit 6c3f6d2
Showing 1 changed file with 46 additions and 0 deletions.
diff --git a/cli/assets/terraform.yml b/cli/assets/terraform.yml
@@ -161,6 +161,52 @@ rules:
     tags:
       - cloudfront
 
+  - id: IAM_ROLE_NOT_ACTION
+    message: Should not use NotAction in assume policy document
+    resource: aws_iam_role
+    severity: WARNING
+    assertions:
+      - none:
+          key: assume_role_policy.Statement[]
+          expressions:
+            - key: NotAction
+              op: present
+    tags:
+      - iam
+      - role
+
+  - id: IAM_ROLE_NOT_PRINCIPAL
+    message: Should not use NotPrincipal in role assume policy document
+    resource: aws_iam_role
+    severity: FAILURE
+    assertions:
+      - none:
+          key: assume_role_policy.Statement[]
+          expressions:
+            - key: NotPrincipal
+              op: present
+    tags:
+      - iam
+      - role
+
+  - id: IAM_ROLE_WILDCARD_ACTION
+    message: Should not use wildcard action in role assume policy document
+    resource: aws_iam_role
+    severity: FAILURE
+    assertions:
+      - none:
+          key: assume_role_policy.Statement[]
+          expressions:
+            - key: Effect
+              op: eq
+              value: Allow
+            - key: Action
+              op: contains
+              value: "*"
+    tags:
+      - iam
+      - role
+
   - id: IAM_ROLE_POLICY_NOT_ACTION
     message: Should not use NotAction in IAM policy
     resource: aws_iam_role_policy