AWS IAM Policy Does Not Grant Network Admin Access

Description

This policy validates that no IAM policies grant admin privileges on network resources. This should be used in conjunction with suppressions for the legitimate network admin policies in your account.

Query · python

import json

from policyuniverse.action_categories import categories_for_actions
from policyuniverse.expander_minimizer import expand_policy
from policyuniverse.policy import Policy

# White listed policies (e.g. the approved network admin policy) can be specified here, or as an
# exception to this policy.

ADMIN_ACTIONS = {
    "Tagging",
    "Write",
}
NETWORK_RESOURCES = {
    "vpc",
    "securitygroup",
    "networkacl",
    "routetable",
}


def policy(resource):
    iam_policy = Policy(expand_policy(json.loads(resource["PolicyDocument"])))
    action_summary = iam_policy.action_summary()

    #
    # These first two checks can technically be skipped and this policy will still return correct
    # results, but they prevent the more computationally expensive check the majority of the time.
    #

    # Check if the policy applies to EC2 resources
    if "ec2" not in action_summary:
        return True

    # Sometimes AWS Service Linked Roles+Policies violate the
    # expectation as expressed in policyuniverse.
    # service-linked roles have a path of /aws-service-role/
    #   service-linked roles and their policies are not editable
    # service-role is editable, and so not included
    if resource.get("Path", "") == "/aws-service-role/":
        return True

    # Check if the policy grants administrative privileges
    if not ADMIN_ACTIONS.intersection(action_summary["ec2"]):
        return True

    # Get the EC2 actions pertaining specifically to network resources
    network_actions = set()
    for statement in iam_policy.statements:
        # Only check statements granting access
        if statement.effect != "Allow":
            continue
        # Only check actions that are granted on network resources
        for action in statement.actions:
            if any(resource in action for resource in NETWORK_RESOURCES):
                network_actions.add(action)

    # For all actions that have been granted on network resources, ensure none grant admin access
    network_actions_summary = categories_for_actions(network_actions)
    return not any(action in ADMIN_ACTIONS for action in network_actions_summary["ec2"])

Analyst notes

Delete the unapproved network admin policy.

Detection tier

Not a detection

This rule makes no claim about adversary activity — it asserts configuration, suppresses an alert, or records a policy violation — so it sits at no rung of the pyramid.

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Medium
Status: Stable
Query type: python
Created: —
Modified: 2024-04-02
Authored by: panther-labs
Source ID: —
Upstream: policies/aws_iam_policies/aws_iam_policy_does_not_grant_network_admin_access.yml
Type: policy
Version: 1
References: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html

ATT&CK

TA0004 T1078