feat(queries): add new aws iam privilege escalation queries

assets/queries/terraform/aws/iam_privilege_escalation/group/glue-UpdateDevEndpoint/metadata.json

@@ -0,0 +1,11 @@
+{
+  "id": "8f3c16b3-354d-45db-8ad5-5066778a9485",
+  "queryName": "Group with privilege escalation by actions 'glue:UpdateDevEndpoint'",
+  "severity": "MEDIUM",
+  "category": "Access Control",
+  "descriptionText": "Group with privilege escalation by actions 'glue:UpdateDevEndpoint' and Resource set to '*'",
+  "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_group",
+  "platform": "Terraform",
+  "descriptionID": "10f17e18",
+  "cloudProvider": "aws"
+}

assets/queries/terraform/aws/iam_privilege_escalation/group/glue-UpdateDevEndpoint/query.rego

@@ -0,0 +1,73 @@
+package Cx
+
+import data.generic.common as common_lib
+
+CxPolicy[result] {
+
+	# get a AWS IAM group
+	input.document[i].resource.aws_iam_group[targetGroup]
+
+    unrecommended_permission_policy_scenarios(targetGroup, "glue:UpdateDevEndpoint")
+
+
+	result := {
+		"documentId": input.document[i].id,
+		"searchKey": sprintf("aws_iam_group[%s]", [targetGroup]),
+		"issueType": "IncorrectValue",
+        "keyExpectedValue": sprintf("group %s is not associated with a policy that has Action set to 'glue:UpdateDevEndpoint' and Resource set to '*'", [targetGroup]),
+		"keyActualValue": sprintf("group %s is associated with a policy that has Action set to 'glue:UpdateDevEndpoint' and Resource set to '*'", [targetGroup]),
+        "searchLine": common_lib.build_search_line(["resource", "aws_iam_group", targetGroup], []),
+	}
+}
+
+
+unrecommended_permission_policy(resourcePolicy, permission) {
+    policy := common_lib.json_unmarshal(resourcePolicy.policy)
+
+    st := common_lib.get_statement(policy)
+	statement := st[_]
+
+	common_lib.is_allow_effect(statement)
+
+    common_lib.equalsOrInArray(statement.Resource, "*")
+    common_lib.equalsOrInArray(statement.Action, lower(permission))
+}
+
+get_group(attachment) = group {
+	group := split(attachment.groups[_], ".")[1]
+} else = group {
+	group := split(attachment.group, ".")[1]
+}
+
+
+unrecommended_permission_policy_scenarios(targetGroup, permission) {
+ 	# get the IAM group policy
+ 	groupPolicy := input.document[_].resource.aws_iam_group_policy[_]
+
+    # get the group referenced in IAM group policy and confirm it is the target group
+    group := split(groupPolicy.group, ".")[1]
+    group == targetGroup
+
+    # verify that the policy is unrecommended
+    unrecommended_permission_policy(groupPolicy, permission)
+} else {
+
+    # find attachment
+    attachments := {"aws_iam_policy_attachment", "aws_iam_group_policy_attachment"} 
+    attachment := input.document[_].resource[attachments[_]][_]
+
+    # get the group referenced in IAM policy attachment and confirm it is the target group
+    group := get_group(attachment)
+    group == targetGroup
+
+    # confirm that policy associated is unrecommend
+    policy := split(attachment.policy_arn, ".")[1]
+
+    policies := {"aws_iam_role_policy", "aws_iam_user_policy", "aws_iam_group_policy", "aws_iam_policy"}
+    resourcePolicy := input.document[_].resource[policies[_]][policy]
+
+    # verify that the policy is unrecommended
+    unrecommended_permission_policy(resourcePolicy, permission)
+
+}
+

assets/queries/terraform/aws/iam_privilege_escalation/group/glue-UpdateDevEndpoint/test/negative1.tf

@@ -0,0 +1,21 @@
+resource "aws_iam_user" "cosmic2" {
+  name = "cosmic2"
+}
+
+resource "aws_iam_user_policy" "inline_policy_run_instances2" {
+  name = "inline_policy_run_instances"
+  user = aws_iam_user.cosmic2.name
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = [
+          "ec2:Describe*",
+        ]
+        Effect   = "Allow"
+        Resource = "*"
+      },
+    ]
+  })
+}

assets/queries/terraform/aws/iam_privilege_escalation/group/glue-UpdateDevEndpoint/test/positive1.tf

@@ -0,0 +1,29 @@
+resource "aws_iam_user" "cosmic" {
+  name = "cosmic"
+}
+
+resource "aws_iam_user_policy" "test_inline_policy" {
+  name = "test_inline_policy"
+  user = aws_iam_user.cosmic.name
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = [
+          "glue:UpdateDevEndpoint",
+        ]
+        Effect   = "Allow"
+        Resource = "*"
+      },
+    ]
+  })
+}
+
+
+resource "aws_iam_policy_attachment" "test-attach" {
+  name       = "test-attachment"
+  users      = [aws_iam_user.cosmic.name]
+  roles      = [aws_iam_role.role.name]
+  groups     = [aws_iam_group.group.name]
+}

assets/queries/terraform/aws/iam_privilege_escalation/group/glue-UpdateDevEndpoint/test/positive_expected_result.json

@@ -0,0 +1,8 @@
+[
+  {
+    "queryName": "Group with privilege escalation by actions 'glue:UpdateDevEndpoint'",
+    "severity": "MEDIUM",
+    "line": 1,
+    "fileName": "positive1.tf"
+  }
+]

assets/queries/terraform/aws/iam_privilege_escalation/group/iam-AddUserToGroup/metadata.json

@@ -0,0 +1,11 @@
+{
+  "id": "970ed7a2-0aca-4425-acf1-0453c9ecbca1",
+  "queryName": "Group with privilege escalation by actions 'iam:AddUserToGroup'",
+  "severity": "MEDIUM",
+  "category": "Access Control",
+  "descriptionText": "Group with privilege escalation by actions 'iam:AddUserToGroup' and Resource set to '*'",
+  "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_group",
+  "platform": "Terraform",
+  "descriptionID": "576ba016",
+  "cloudProvider": "aws"
+}

assets/queries/terraform/aws/iam_privilege_escalation/group/iam-AddUserToGroup/query.rego

@@ -0,0 +1,73 @@
+package Cx
+
+import data.generic.common as common_lib
+
+CxPolicy[result] {
+
+	# get a AWS IAM group
+	input.document[i].resource.aws_iam_group[targetGroup]
+
+    unrecommended_permission_policy_scenarios(targetGroup, "iam:AddUserToGroup")
+
+
+	result := {
+		"documentId": input.document[i].id,
+		"searchKey": sprintf("aws_iam_group[%s]", [targetGroup]),
+		"issueType": "IncorrectValue",
+        "keyExpectedValue": sprintf("group %s is not associated with a policy that has Action set to 'iam:AddUserToGroup' and Resource set to '*'", [targetGroup]),
+		"keyActualValue": sprintf("group %s is associated with a policy that has Action set to 'iam:AddUserToGroup' and Resource set to '*'", [targetGroup]),
+        "searchLine": common_lib.build_search_line(["resource", "aws_iam_group", targetGroup], []),
+	}
+}
+
+
+unrecommended_permission_policy(resourcePolicy, permission) {
+    policy := common_lib.json_unmarshal(resourcePolicy.policy)
+
+    st := common_lib.get_statement(policy)
+	statement := st[_]
+
+	common_lib.is_allow_effect(statement)
+
+    common_lib.equalsOrInArray(statement.Resource, "*")
+    common_lib.equalsOrInArray(statement.Action, lower(permission))
+}
+
+get_group(attachment) = group {
+	group := split(attachment.groups[_], ".")[1]
+} else = group {
+	group := split(attachment.group, ".")[1]
+}
+
+
+unrecommended_permission_policy_scenarios(targetGroup, permission) {
+ 	# get the IAM group policy
+ 	groupPolicy := input.document[_].resource.aws_iam_group_policy[_]
+
+    # get the group referenced in IAM group policy and confirm it is the target group
+    group := split(groupPolicy.group, ".")[1]
+    group == targetGroup
+
+    # verify that the policy is unrecommended
+    unrecommended_permission_policy(groupPolicy, permission)
+} else {
+
+    # find attachment
+    attachments := {"aws_iam_policy_attachment", "aws_iam_group_policy_attachment"} 
+    attachment := input.document[_].resource[attachments[_]][_]
+
+    # get the group referenced in IAM policy attachment and confirm it is the target group
+    group := get_group(attachment)
+    group == targetGroup
+
+    # confirm that policy associated is unrecommend
+    policy := split(attachment.policy_arn, ".")[1]
+
+    policies := {"aws_iam_role_policy", "aws_iam_user_policy", "aws_iam_group_policy", "aws_iam_policy"}
+    resourcePolicy := input.document[_].resource[policies[_]][policy]
+
+    # verify that the policy is unrecommended
+    unrecommended_permission_policy(resourcePolicy, permission)
+
+}
+

assets/queries/terraform/aws/iam_privilege_escalation/group/iam-AddUserToGroup/test/negative1.tf

@@ -0,0 +1,21 @@
+resource "aws_iam_user" "cosmic2" {
+  name = "cosmic2"
+}
+
+resource "aws_iam_user_policy" "inline_policy_run_instances2" {
+  name = "inline_policy_run_instances"
+  user = aws_iam_user.cosmic2.name
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = [
+          "ec2:Describe*",
+        ]
+        Effect   = "Allow"
+        Resource = "*"
+      },
+    ]
+  })
+}

assets/queries/terraform/aws/iam_privilege_escalation/group/iam-AddUserToGroup/test/positive1.tf

@@ -0,0 +1,29 @@
+resource "aws_iam_user" "cosmic" {
+  name = "cosmic"
+}
+
+resource "aws_iam_user_policy" "test_inline_policy" {
+  name = "test_inline_policy"
+  user = aws_iam_user.cosmic.name
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = [
+          "iam:AddUserToGroup",
+        ]
+        Effect   = "Allow"
+        Resource = "*"
+      },
+    ]
+  })
+}
+
+
+resource "aws_iam_policy_attachment" "test-attach" {
+  name       = "test-attachment"
+  users      = [aws_iam_user.cosmic.name]
+  roles      = [aws_iam_role.role.name]
+  groups     = [aws_iam_group.group.name]
+}

assets/queries/terraform/aws/iam_privilege_escalation/group/iam-AddUserToGroup/test/positive_expected_result.json

@@ -0,0 +1,8 @@
+[
+  {
+    "queryName": "Group with privilege escalation by actions 'iam:AddUserToGroup'",
+    "severity": "MEDIUM",
+    "line": 1,
+    "fileName": "positive1.tf"
+  }
+]

assets/queries/terraform/aws/iam_privilege_escalation/group/iam-AttachGroupPolicy/metadata.json

@@ -0,0 +1,11 @@
+{
+  "id": "70b42736-efee-4bce-80d5-50358ed94990",
+  "queryName": "Group with privilege escalation by actions 'iam:AttachGroupPolicy'",
+  "severity": "MEDIUM",
+  "category": "Access Control",
+  "descriptionText": "Group with privilege escalation by actions 'iam:AttachGroupPolicy' and Resource set to '*'",
+  "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_group",
+  "platform": "Terraform",
+  "descriptionID": "e42aec0c",
+  "cloudProvider": "aws"
+}

assets/queries/terraform/aws/iam_privilege_escalation/group/iam-AttachGroupPolicy/query.rego

@@ -0,0 +1,73 @@
+package Cx
+
+import data.generic.common as common_lib
+
+CxPolicy[result] {
+
+	# get a AWS IAM group
+	input.document[i].resource.aws_iam_group[targetGroup]
+
+    unrecommended_permission_policy_scenarios(targetGroup, "iam:AttachGroupPolicy")
+
+
+	result := {
+		"documentId": input.document[i].id,
+		"searchKey": sprintf("aws_iam_group[%s]", [targetGroup]),
+		"issueType": "IncorrectValue",
+        "keyExpectedValue": sprintf("group %s is not associated with a policy that has Action set to 'iam:AttachGroupPolicy' and Resource set to '*'", [targetGroup]),
+		"keyActualValue": sprintf("group %s is associated with a policy that has Action set to 'iam:AttachGroupPolicy' and Resource set to '*'", [targetGroup]),
+        "searchLine": common_lib.build_search_line(["resource", "aws_iam_group", targetGroup], []),
+	}
+}
+
+
+unrecommended_permission_policy(resourcePolicy, permission) {
+    policy := common_lib.json_unmarshal(resourcePolicy.policy)
+
+    st := common_lib.get_statement(policy)
+	statement := st[_]
+
+	common_lib.is_allow_effect(statement)
+
+    common_lib.equalsOrInArray(statement.Resource, "*")
+    common_lib.equalsOrInArray(statement.Action, lower(permission))
+}
+
+get_group(attachment) = group {
+	group := split(attachment.groups[_], ".")[1]
+} else = group {
+	group := split(attachment.group, ".")[1]
+}
+
+
+unrecommended_permission_policy_scenarios(targetGroup, permission) {
+ 	# get the IAM group policy
+ 	groupPolicy := input.document[_].resource.aws_iam_group_policy[_]
+
+    # get the group referenced in IAM group policy and confirm it is the target group
+    group := split(groupPolicy.group, ".")[1]
+    group == targetGroup
+
+    # verify that the policy is unrecommended
+    unrecommended_permission_policy(groupPolicy, permission)
+} else {
+
+    # find attachment
+    attachments := {"aws_iam_policy_attachment", "aws_iam_group_policy_attachment"} 
+    attachment := input.document[_].resource[attachments[_]][_]
+
+    # get the group referenced in IAM policy attachment and confirm it is the target group
+    group := get_group(attachment)
+    group == targetGroup
+
+    # confirm that policy associated is unrecommend
+    policy := split(attachment.policy_arn, ".")[1]
+
+    policies := {"aws_iam_role_policy", "aws_iam_user_policy", "aws_iam_group_policy", "aws_iam_policy"}
+    resourcePolicy := input.document[_].resource[policies[_]][policy]
+
+    # verify that the policy is unrecommended
+    unrecommended_permission_policy(resourcePolicy, permission)
+
+}
+