pacu
pacu copied to clipboard
iam__backdoor_assume_role overwrites IAM boto client object when user arn is not specified
It looks like this line is looking for an IAM boto client object. However, client
gets overwritten with an STS boto client on line 80 if a user arn is not specified.
https://github.com/RhinoSecurityLabs/pacu/blob/e95b3ff2898b4954fe61411b314414b33e1f5750/pacu/modules/iam__backdoor_assume_role/main.py#L105
The result is an error like this:
<class 'AttributeError'>: 'STS' object has no attribute 'update_assume_role_policy'
I just put up a PR proposing a fix: #304
Looks like this was merged and fixed