CloudFormation Stack With IAM Role

01 Sign in to the AWS Management Console.

02 Navigate to Amazon CloudFormation console at https://console.aws.amazon.com/cloudformation.

03 Click on the name (link) of the CloudFormation stack that you want to examine.

04 Select the Stack info tab to access the configuration information available for the selected stack.

05 In the Overview section, check the IAM role attribute value to determine if the CloudFormation stack is using IAM roles. If the IAM role configuration attribute does not have a value, there is no IAM role configured for the selected stack, therefore the Audit process ends here. If the IAM role attribute has a value, note the identifier of associated role, and continue the Audit process with the next step.

06 Navigate to Amazon IAM console at https://console.aws.amazon.com/iam/.

07 In the navigation panel, under Access management, choose Roles.

08 Find the IAM role associated with your CloudFormation stack and click on its name (link).

09 Select the Permissions tab to access the identity-based policies attached to the selected IAM role.

10 In the Permissions policies section, click on the Expand button (plus icon) available next to each attached policy and check each policy document defined for the IAM role. If one or more policies contain overly permissive elements such as "Effect": "Allow", "Action": "*", "Resource": "*", the IAM service role associated with your Amazon CloudFormation stack is not using the Principle of Least Privilege (POLP) to define permissions and this can lead to unwanted privilege escalation.

11 Repeat step no. 3 – 10 for each Amazon CloudFormation stack available within the current AWS region.

12 Change the AWS cloud region from the navigation bar and repeat the Audit process for other regions.

01 Run list-stacks command (OSX/Linux/UNIX) to list the name of each active Amazon CloudFormation stack available in the selected AWS region:

aws cloudformation list-stacks
  --region us-east-1
  --stack-status-filter CREATE_COMPLETE
  --output table
  --query 'StackSummaries[*].StackName'

02 The command output should return a table with the requested stack name(s):

-----------------------------
|         ListStacks        |
+---------------------------+
| cc-production-web-stack   |
| cc-project5-test-stack    |
+---------------------------+

03 Run describe-stackscommand (OSX/Linux/UNIX) using custom query filters to describe the ARN of the IAM service role associated with the selected Amazon CloudFormation stack:

aws cloudformation describe-stacks
  --region us-east-1
  --stack-name cc-production-web-stack
  --query 'Stacks[*].RoleARN'

04 The command output should return the requested Amazon Resource Name (ARN). If the describe-stacks command output returns an empty array (i.e. []), there is no IAM role configured for the selected stack, therefore the Audit process ends here. If the command output returns the ARN of the associated IAM role, continue the Audit process with the next step:

[
	"arn:aws:iam::123456789012:role/cc-stack-admin-role"
]

05 To examine the access permissions defined for the associated IAM role, perform one of the following set of commands:

1. For managed IAM policies:
   • Run list-attached-role-policies command (OSX/Linux/UNIX) using the name of the IAM service role as the identifier parameter (extracted from the resource ARN) to list the managed policies attached to the selected role:
     aws iam list-attached-role-policies
       --role-name cc-stack-admin-role
     

   • The command output should return the IAM policies metadata:
     {
     	"AttachedPolicies": [
     		{
     		   "PolicyName": "AdministratorAccess",
     		   "PolicyArn": "arn:aws:iam::aws:policy/AdministratorAccess"
     		}
     	]
     }
     

   • Run get-policycommand (OSX/Linux/UNIX) using the ARN of the managed policy returned at the previous step as the identifier parameter to list the policy metadata:
     aws iam get-policy
       --policy-arn arn:aws:iam::aws:policy/AdministratorAccess
     

   • The command output should return the requested configuration metadata:
     {
     	"Policy": {
     		"PolicyName": "AdministratorAccess",
     		"Description": "Provides full access to AWS services and resources.",
     		"CreateDate": "2015-02-06T18:39:46Z",
     		"AttachmentCount": 2,
     		"IsAttachable": true,
     		"PolicyId": "AAAABBBBCCCCDDDDEEEE",
     		"DefaultVersionId": "v1",
     		"Path": "/",
     		"Arn": "arn:aws:iam::aws:policy/AdministratorAccess",
     		"UpdateDate": "2015-02-06T18:39:46Z"
     	}
     }
     

2. For inline IAM policies:
   • Run list-role-policies command (OSX/Linux/UNIX) using the name of the IAM service role as the identifier parameter, to list the inline policies defined to the selected role:
     aws iam list-role-policies
       --role-name cc-stack-admin-role
     

   • The command output should return the inline IAM policies metadata:
     {
     	"PolicyNames": [
     		"cc-cfn-admin-policy"
     	]
     }
     

   • Run get-role-policy command (OSX/Linux/UNIX) using the name of the inline policy returned at the previous step as the identifier parameter to list the policy document:
     aws iam get-role-policy
       --role-name cc-stack-admin-role
       --policy-name cc-cfn-admin-policy
       --query 'PolicyDocument'
     

   • The command output should return the requested policy document in JSON format:
     {
     	"Version": "2012-10-17",
     	"Statement": [
     		{
     			"Effect": "Allow",
     			"Action": [
     				"cloudformation:*"
     			],
     			"Resource": "*"
     		}
     	]
     }
     

06 Check each policy document defined for the IAM role. If one or more policies contain overly permissive elements such as "Effect": "Allow", "Action": "*", "Resource": "*", the IAM service role associated with your Amazon CloudFormation stack is not using the Principle of Least Privilege (POLP) to define permissions and this can lead to unwanted privilege escalation.

07 Repeat steps no. 3 – 6 for each Amazon CloudFormation stack available in the selected AWS region.

08 Change the AWS cloud region by updating the --region command parameter value and repeat the Audit process for other regions.

01 Sign in to the AWS Management Console.

02 Navigate to Amazon IAM console at https://console.aws.amazon.com/iam/.

03 In the navigation panel, under Access management, choose Roles.

04 Click on the name (link) of the IAM service role associated with your CloudFormation stack.

05 Select the Permissions tab to access the identity-based policies attached to the selected role.

06 In the Permissions policies section, perform the following actions based on the policy type:

1. For managed IAM policies (AWS-managed and customer-managed policies):
   • Choose Remove to detach the overly permissive policy from the selected IAM role.
   • Inside the Remove confirmation box, choose Delete to confirm the action.
   • Choose Add permissions and select Attach policies to attach new managed IAM policies to the selected role. Select one or more IAM policies from the provided list based on your role access requirements. Follow the Principle of Least Privilege (the security concept of providing every identity the minimal set of permissions required to perform successfully its tasks) when selecting the managed policies to attach to your IAM role. Choose Attach policies to confirm your action.
2. For inline IAM policies:
   • Choose the overly permissive inline policy embedded within the selected IAM role, click on the Expand button (plus icon), and select Edit.
   • Select the JSON tab and customize the policy document according to your IAM role access requirements. Follow the Principle of Least Privilege (POLP) when editing the inline policy associated with to your IAM role.
   • Choose Review policy to review the inline policy before you save your changes.
   • Choose Save changes to apply the permission changes.

07 Repeat steps no. 4 – 6 for each associated IAM role that you want to reconfigure, available in your AWS cloud account.

01 Define new permissions for the associated IAM service role by following the Principle of Least Privilege, and save the policy document to a JSON file named cc-iam-role-policy.json.

02 Depending on whether you need to update a managed IAM policy or an inline IAM policy, execute one of the following sets of commands:

1. If the policy attached to your IAM role is a managed policy, run create-policy-version command (OSX/Linux/UNIX) using the policy document created at the previous step (i.e. cc-iam-role-policy.json) to create a new and compliant version of the attached managed policy. The following command request example creates a new version of an IAM managed policy identified by the ARN "arn:aws:iam::123456789012:policy/cc-cnf-managed-policy" and makes it the default version:
   aws iam create-policy-version
     --policy-arn arn:aws:iam::123456789012:policy/cc-cfn-managed-policy
     --policy-document file://cc-iam-role-policy.json
     --set-as-default
   

2. The command output should return the metadata of the new managed policy version:
   {
   	"PolicyVersion": {
   		"CreateDate": "2020-12-18T10:00:00Z",
   		"VersionId": "v2",
   		"IsDefaultVersion": true
   	}
   }
   

3. If the policy associated with your Amazon IAM role is an inline policy, run put-role-policy command (OSX/Linux/UNIX) using the policy document created at the previous step (i.e. cc-iam-role-policy.json) to update the permissions of the selected inline policy. The following command request example updates an inline IAM policy named "cc-cfn-inline-policy" (the command does not produce an output):
   aws iam put-role-policy
     --role-name cc-stack-admin-role
     --policy-name cc-cfn-inline-policy
     --policy-document file://cc-iam-role-policy.json
   

03 Repeat steps no. 1 and 2 for each associated IAM role that you want to reconfigure, available in your AWS cloud account.