IAM Administrator Role Policy Attached

AnalysisType: rule
Filename: aws_iam_attach_admin_role_policy.py
RuleID: "AWS.IAM.AttachAdminRolePolicy"
DisplayName: "IAM Administrator Role Policy Attached"
Enabled: true
LogTypes:
  - AWS.CloudTrail
CreateAlert: false
Reports:
  CIS:
    - 1.1
  MITRE ATT&CK:
    - TA0007:T1078
Severity: Info
Description: >
  An IAM role policy was attached with Administrator Access, which could indicate a potential security risk.
Runbook: Check if the action was expected. If not, remove the policy from the role.
Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html
Tests:
  - Name: IAM Role Policy Attached with Administrator Access
    ExpectedResult: true
    Log:
      {
        "eventVersion": "1.05",
        "userIdentity":
          {
            "type": "AssumedRole",
            "principalId": "tester",
            "arn": "arn:aws:sts::123456789012:assumed-role/tester",
            "accountId": "123456789012",
            "accessKeyId": "1",
            "sessionContext":
              {
                "sessionIssuer":
                  {
                    "type": "Role",
                    "principalId": "1111",
                    "arn": "arn:aws:iam::123456789012:role/tester",
                    "accountId": "123456789012",
                    "userName": "Tester",
                  },
                "webIdFederationData": {},
                "attributes":
                  {
                    "mfaAuthenticated": "true",
                    "creationDate": "2019-01-01T00:00:00Z",
                  },
              },
          },
        "eventTime": "2019-01-01T00:00:00Z",
        "eventSource": "iam.amazonaws.com",
        "eventName": "AttachRolePolicy",
        "awsRegion": "us-west-2",
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "console.amazonaws.com",
        "requestParameters":
          {
            "policyArn": "arn:aws:iam::aws:policy/AdministratorAccess",
            "roleName": "new-role"
          },
        "responseElements": null,
        "requestID": "1",
        "eventID": "1",
        "readOnly": false,
        "eventType": "AwsApiCall",
        "recipientAccountId": "123456789012",
      }
  - Name: IAM Role Policy Attached without Administrator Access
    ExpectedResult: false
    Log:
      {
        "eventVersion": "1.05",
        "userIdentity":
          {
            "type": "AssumedRole",
            "principalId": "tester",
            "arn": "arn:aws:sts::123456789012:assumed-role/tester",
            "accountId": "123456789012",
            "accessKeyId": "1",
            "sessionContext":
              {
                "sessionIssuer":
                  {
                    "type": "Role",
                    "principalId": "1111",
                    "arn": "arn:aws:iam::123456789012:role/tester",
                    "accountId": "123456789012",
                    "userName": "Tester",
                  },
                "webIdFederationData": {},
                "attributes":
                  {
                    "mfaAuthenticated": "true",
                    "creationDate": "2019-01-01T00:00:00Z",
                  },
              },
          },
        "eventTime": "2019-01-01T00:00:00Z",
        "eventSource": "iam.amazonaws.com",
        "eventName": "AttachRolePolicy",
        "awsRegion": "us-west-2",
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "console.amazonaws.com",
        "requestParameters":
          {
            "policyArn": "arn:aws:iam::aws:policy/ReadOnlyAccess",
            "roleName": "new-role"
          },
        "responseElements": null,
        "requestID": "1",
        "eventID": "1",
        "readOnly": false,
        "eventType": "AwsApiCall",
        "recipientAccountId": "123456789012",
      }

# ------ paired body: aws_iam_attach_admin_role_policy.py ------

from panther_aws_helpers import aws_cloudtrail_success, aws_rule_context


def rule(event):
    if not aws_cloudtrail_success(event) or event.get("eventName") != "AttachRolePolicy":
        return False

    policy = event.deep_get("requestParameters", "policyArn", default="POLICY_NOT_FOUND")

    return policy.endswith("AdministratorAccess")


def alert_context(event):
    context = aws_rule_context(event)
    context["request_rolename"] = event.deep_get(
        "requestParameters", "roleName", default="ROLENAME_NOT_FOUND"
    )
    return context