terraform-aws-ecs-codepipeline

terraform-aws-ecs-codepipeline copied to clipboard

The IAM policy for the role allows * too too many aws services without resource restrictions. Allowing a var supplied policy here could be a good first step. (https://github.com/cloudposse/terraform-aws-ecs-codepipeline/blame/master/main.tf#L66-L87).

Uh. Another iam:PassRole to * again. See https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment/issues/147 and the source Unit 42 Cloud Threat Report: Misconfigured IAM Roles Lead to Thousands of Compromised Cloud Workloads.

That's a great suggestion. We accept PRs and always welcome new contributors.

I beleive this in main.tf is the code in question:

data "aws_iam_policy_document" "default" {
  statement {
    sid = ""

    actions = [
      "ec2:*",
      "elasticloadbalancing:*",
      "autoscaling:*",
      "cloudwatch:*",
      "s3:*",
      "sns:*",
      "cloudformation:*",
      "rds:*",
      "sqs:*",
      "ecs:*",
      "iam:PassRole"
    ]

    resources = ["*"]
    effect    = "Allow"
  }
}

That's an awful lot of asterisks. But I'm not clear if this policy is actually being used. aws_iam_role_policy_attachment.default is only referenced in depends_on in two aws_codepipeline resources. But if it's unneeded, why is it declared at all?