terraform-aws-elastic-beanstalk-environment
terraform-aws-elastic-beanstalk-environment copied to clipboard
cloudposse
SECURITY: iam:PassRole is dangerous
Describe the Bug
The inline policy *-eb-default in main.tf line 138 is generally overreaching with all of it's permissions, but in particular Action: ["iam:PassRole"] with Resource: "*" is downright dangerous. See Unit 42 Cloud Threat Report: Misconfigured IAM Roles Lead to Thousands of Compromised Cloud Workloads for details on how to exploit.
Expected Behavior
Privilege escalation should not be possible. iam:PassRole (and iam:ListRole) should not be used.
@razorsedge what do you think is the best approach? Add inputs to specify a resource pattern for each class of permissions, or make the module more opinionated and specify the resource pattern using the module context?
@joe-niland My naive approach would be to completely remove those two actions. I do not understand why they would be needed. Otherwise, forcing a user to specify the role to be passed else not allow that action.