feat: updates kms comp with embedded policy creation #523

Gowiem · 2022-11-10T21:21:12Z

what

Updates the KMS module to support embedded policy creation

why

This allows for easy wiring in of aws-team-role roles into the KMS policy, so we do something like "Admins in the dev account have access to use this Key"

references

N/A

bridgecrew

Bridgecrew has found errors in this PR ⬇️

bridgecrew · 2022-11-10T21:22:55Z

modules/kms/main.tf

  context = module.this.context
 }
+
+data "aws_iam_policy_document" "key_policy" {


Ensure IAM policies does not allow write access without constraint
Resource: aws_iam_policy_document.key_policy | ID: BC_AWS_IAM_57

How to Fix

data "aws_iam_policy_document" "example" { statement { sid = "1" effect = "Allow" actions = [ "s3:*" ] resources = [ "foo", ] } }

Description
This policy allows actions that permit modification of resource-based policies or can otherwise can expose AWS resources to the public via similar actions that can lead to resource exposure.
For example:
1 - s3:PutBucketPolicy, s3:PutBucketAcl, and s3:PutObjectAcl grant permissions to modify the properties of S3 buckets or objects for new or existing objects in an S3 bucket, which could expose objects to rogue actors or to the internet.
2 - ecr:SetRepositoryPolicy could allow an attacker to exfiltrate container images (which sometimes unintentionally contain secrets and non-public information), tamper with container images, or otherwise modify.
3 - iam:UpdateAssumeRolePolicy could allow an attacker to create a backdoor by assuming a privileged role in the victim account from an external account.
The ability to modify AWS Resource Access Manager, which could allow a malicious actor to share a VPC hosting sensitive or internal services to rogue AWS accounts
Attackers can easily exploit Resource Exposure permissions to expose resources to rogue users or the internet, as shown by endgame, an AWS pentesting tool that was also released by Salesforce.

For more info, visit cloudsplaning documentation
https://cloudsplaining.readthedocs.io/en/latest/glossary/resource-exposure/

bridgecrew · 2022-11-10T21:22:55Z

modules/kms/main.tf

  context = module.this.context
 }
+
+data "aws_iam_policy_document" "key_policy" {


Ensure IAM policies do not allow permissions management / resource exposure without constraint
Resource: aws_iam_policy_document.key_policy | ID: BC_AWS_IAM_56

How to Fix

data "aws_iam_policy_document" "example" { statement { sid = "1" effect = "Allow" actions = [ "s3:*" ] resources = [ "foo", ] } }

Description
This policy allows actions that permit modification of resource-based policies or can otherwise can expose AWS resources to the public via similar actions that can lead to resource exposure.
For example:
1 - s3:PutBucketPolicy, s3:PutBucketAcl, and s3:PutObjectAcl grant permissions to modify the properties of S3 buckets or objects for new or existing objects in an S3 bucket, which could expose objects to rogue actors or to the internet.
2 - ecr:SetRepositoryPolicy could allow an attacker to exfiltrate container images (which sometimes unintentionally contain secrets and non-public information), tamper with container images, or otherwise modify.
3 - iam:UpdateAssumeRolePolicy could allow an attacker to create a backdoor by assuming a privileged role in the victim account from an external account.
The ability to modify AWS Resource Access Manager, which could allow a malicious actor to share a VPC hosting sensitive or internal services to rogue AWS accounts
Attackers can easily exploit Resource Exposure permissions to expose resources to rogue users or the internet, as shown by endgame, an AWS pentesting tool that was also released by Salesforce.

For more info, visit cloudsplaning documentation
https://cloudsplaining.readthedocs.io/en/latest/glossary/resource-exposure/

nitrocode · 2023-02-18T16:00:57Z

modules/kms/main.tf

@@ -1,15 +1,80 @@
+locals {
+  account_id        = data.aws_caller_identity.current.account_id
+  account_principal = "arn:aws:iam::${local.account_id}:root"


Let's use the data source here for govcloud

Suggested change

account_principal = "arn:aws:iam::${local.account_id}:root"

account_principal = "arn:${data.aws_partition.current.partition}:iam::${local.account_id}:root"

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition

nitrocode · 2023-02-18T16:01:23Z

modules/kms/main.tf

+
+    principals {
+      type        = "AWS"
+      identifiers = local.administration_principals


Suggested change

identifiers = local.administration_principals

identifiers = [local.account_principal]

nitrocode · 2023-02-18T16:01:52Z

modules/kms/main.tf

+  administration_principals = [
+    local.account_principal
+  ]
+


This local doesn't seem very useful

Suggested change

administration_principals = [

local.account_principal

]

nitrocode · 2023-02-18T16:02:13Z

modules/kms/main.tf

+  )))
+}
+
+data "aws_caller_identity" "current" {}


Suggested change

data "aws_caller_identity" "current" {}

data "aws_caller_identity" "current" {}

data "aws_partition" "current" {}

nitrocode · 2023-02-18T16:03:20Z

modules/kms/variables.tf

+variable "description" {
+  type        = string
+  description = "The description for the KMS Key."
+  default     = null


If the description isn't set to the original value of Parameter Store KMS master key, won't that cause people's kms keys to be recreated?

nitrocode · 2023-02-18T16:03:37Z

modules/kms/variables.tf

-  default     = "Parameter Store KMS master key"
-  description = "The description of the key as viewed in AWS console"
+  default     = "ENCRYPT_DECRYPT"
+  description = "Specifies the intended use of the key. Valid values: `ENCRYPT_DECRYPT` or `SIGN_VERIFY`."


Should we add a validation rule here or is this already done by the upstream module?

nitrocode · 2023-02-18T16:04:31Z

modules/kms/variables.tf

  type        = string
-  default     = ""
-  description = "The display name of the alias. The name must start with the word `alias` followed by a forward slash. If not specified, the alias name will be auto-generated."
+  default     = "SYMMETRIC_DEFAULT"


Is this a breaking change or is this the normal default and we're just being explicit?

nitrocode · 2023-02-18T16:06:31Z

modules/kms/main.tf

+      "kms:*",
+    ]
+
+    resources = ["*"]


It would be good to allow overriding the resources here so users of this component can give granular permissions to kms. These would also allay warnings by bridgecrew shown above.

nitrocode · 2023-02-18T16:16:49Z

modules/kms/main.tf

+      identifiers = local.principals
+    }
+  }
+}


Instead of hard coding this policy here, can we utilize this module and expose the inputs as variables so we can be as flexible as possible from the YAML?

https://github.com/cloudposse/terraform-aws-iam-policy

e.g.

components: terraform: kms: vars: policy: iam_policy_statements: KeyAdministration: effect: "Allow" actions: - "kms:*" resources: - "*" principals: type: "AWS" # This may be something we can contribute to the upstream module to dynamically fill these %s in # or it can be added by the HCL for this component identifiers: - "arn:%s:iam::%s:root" KeyUsage: effect: "Allow" actions: - "kms:Encrypt" - "kms:Decrypt" - "kms:ReEncrypt*" - "kms:GenerateDataKey*" - "kms:DescribeKey" resources: - "*" principals: type: "AWS" # Same here, these can be provided by the HCL unless this `identifiers` key is provided identifiers: - "..."

Gowiem added 3 commits November 10, 2022 12:11

feat: updates kms comp with embedded policy creation

5549544

chore: adds back policy var for backwards compatibility

d5bf21f

chore: updates kms/README.md with terradocs placeholders

b77fbe0

Gowiem requested review from nitrocode and Benbentwo November 10, 2022 21:21

Gowiem requested a review from a team as a code owner November 10, 2022 21:21

Gowiem self-assigned this Nov 10, 2022

Gowiem requested review from a team as code owners November 10, 2022 21:21

Gowiem requested review from dotCipher and woz5999 November 10, 2022 21:21

pre-commit fixes

0409e70

bridgecrew bot reviewed Nov 10, 2022

View reviewed changes

nitrocode reviewed Feb 18, 2023

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: updates kms comp with embedded policy creation #523

feat: updates kms comp with embedded policy creation #523

Gowiem commented Nov 10, 2022

bridgecrew bot left a comment

bridgecrew bot Nov 10, 2022

bridgecrew bot Nov 10, 2022

nitrocode Feb 18, 2023

nitrocode Feb 18, 2023

nitrocode Feb 18, 2023

nitrocode Feb 18, 2023

nitrocode Feb 18, 2023

nitrocode Feb 18, 2023

nitrocode Feb 18, 2023

nitrocode Feb 18, 2023

nitrocode Feb 18, 2023

	account_principal = "arn:aws:iam::${local.account_id}:root"
	account_principal = "arn:${data.aws_partition.current.partition}:iam::${local.account_id}:root"

	identifiers = local.administration_principals
	identifiers = [local.account_principal]

feat: updates kms comp with embedded policy creation #523

Are you sure you want to change the base?

feat: updates kms comp with embedded policy creation #523

Conversation

Gowiem commented Nov 10, 2022

what

why

references

bridgecrew bot left a comment

Choose a reason for hiding this comment

bridgecrew bot Nov 10, 2022

Choose a reason for hiding this comment

How to Fix

Description

bridgecrew bot Nov 10, 2022

Choose a reason for hiding this comment

How to Fix

Description

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment