prowler icon indicating copy to clipboard operation
prowler copied to clipboard

fix(check120): correct AWS support policy name

Open JArmandoG opened this issue 2 years ago • 1 comments

According to the official documentation, which the check refers to (URL provided by the variable $CHECK_DOC_check120), the policy is not "AWSSupportAccess" but "AWSSupportServiceRolePolicy". The policy AWSSupportAccess check returns FAIL because it is not attached to any entity (The response in line 31 is empty), and it seems correct for this check to call the AWSSupportServiceRolePolicy instead

Context

I was getting FAIL for check120, even though I had the correct configuration according to this check's official AWS documentation so I decided to debug the code and found that AWSSupportServiceRolePolicy is the correct role to extract information from in order to verify this check

NOTE: I followed only the provided URL for this check to debug and correct this https://docs.aws.amazon.com/awssupport/latest/user/using-service-linked-roles-sup.html

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

JArmandoG avatar Aug 08 '22 14:08 JArmandoG

I just checked the documentation (https://docs.aws.amazon.com/awssupport/latest/user/accessing-support.html) and it seems that the policy called AWSSupportAccess (The original one Prowler checks for), which "grants an IAM user access to AWS Support. An IAM user with this policy can access all AWS Support operations and resources." is what Prowler originally checked for.

If this situation is what we're trying to check for in check120, and I'm wrong about this PR, then maybe we should change the URL in the variable $CHECK_DOC_check120

JArmandoG avatar Aug 08 '22 15:08 JArmandoG

Hi @JArmandoG, as you mentioned above, this check is for verifying if any IAM identity has access to manage incidents with AWS Support. However, AWSSupportServiceRolePolicy is for allowing AWS Support to manage incidents in your account. I have modify the related URL for the correct one that you indicated. Thank you for four contribution!

sergargar avatar Aug 23 '22 10:08 sergargar