kbroughton / aws-labs Goto Github PK

sts:AssumeRole has some interesting properties

If the role being assumed has the sts:AssumeRole permission then the role can assume itself NO MATTER WHAT THE CONDITION BLOCK SAYS. The condition block is ignored when the temp creds for a role are used to assume the same role.

Build a lab to explore this. This is very relevant to externalID attacks.

Also, assume-role has a max 12 hr time limit, but again, with the ability to assume itself, this can be extended indefinitely.
https://www.cyberark.com/resources/threat-research-blog/wild-temporary-tokens-and-where-to-find-them-aws-edition

Also explore assume-role across aws accounts and see if there is any difference in rules.

setup:
NotAction policy restricting iam:, sts:

Can we use ConfigRule or other ServiceLinked role to modify existing Config task?

I can change Config Rules
Config triggers lambda and associates role because it has PassRole:* Condition passedToService: Config or soemthing.

https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules_nodejs.html

This describes having a jupyter notebook hosted on Lambda
https://towardsdatascience.com/how-to-build-an-aws-lambda-for-data-science-cec62deaf0e9

Elaborate on this question to make a new passrole lab

From Cloud Security Form Slack

I have a question with regards to below. Its from below article. It states “If there is no condition field, the principal can pass a role to any service.” (point #3). But my question is, lets say the “DevOpsEC2-*” role has trust relationship with only EC2…. why would i be able to pass this to any service other than EC2 ?? I hope i am making sense
https://unit42.paloaltonetworks.com/iam-roles-compromised-workloads/

you are correct, it wouldn't work if the trust policy didn't list it as a service however, the main difference is that by adding thee passedtoservice, your prevention of passing that role to a service is done so in the sense that the person who is doing the operation might have accesss to modify the trust policy on the role being passed.