skip: Merge remote-tracking branch 'origin/update_iam_per_policy' int…

…o feature/policy_testing_v2
epam · Jun 21, 2024 · 2483753 · 2483753
2 parents 7b1d832 + 5508d24
commit 2483753
Show file tree

Hide file tree

Showing 9 changed files with 214 additions and 212 deletions.
diff --git a/auto_policy_testing/scripts/exception_rules.py b/auto_policy_testing/scripts/exception_rules.py
@@ -60,7 +60,8 @@
         "glue",
         "account",
         "workspaces",
-        "iam"
+        "iam",
+        "cloudtrail"
     ],
     "sleep_before_scan": [
         "account",

diff --git a/iam/All-permissions_1.json b/iam/All-permissions_1.json
diff --git a/...aws-001-ensure_mfa_is_enabled_for_all_iam_users_with_console_password/iam/001-policy.json b/...aws-001-ensure_mfa_is_enabled_for_all_iam_users_with_console_password/iam/001-policy.json
@@ -5,6 +5,7 @@
             "Effect": "Allow",
             "Action": [
                 "iam:GetCredentialReport",
+                "iam:GenerateCredentialReport",
                 "iam:ListUsers",
                 "iam:GetUser"
             ],

diff --git a/terraform/ecc-aws-002-ensure_access_keys_are_rotated_every_90_days/iam/002-policy.json b/terraform/ecc-aws-002-ensure_access_keys_are_rotated_every_90_days/iam/002-policy.json
@@ -7,6 +7,7 @@
             "Action": [
                 "iam:ListUsers",
                 "iam:GetUser",
+                "iam:GenerateCredentialReport",
                 "iam:GetCredentialReport"
             ],
             "Resource": "*"

diff --git a/terraform/ecc-aws-026-rds_instance_with_no_backups/iam/026-policy.json b/terraform/ecc-aws-026-rds_instance_with_no_backups/iam/026-policy.json
@@ -4,7 +4,7 @@
         {
             "Effect": "Allow",
             "Action": [
-                "tag:GetResources"
+                "rds:DescribeDBInstances"
             ],
             "Resource": "*"
         }

diff --git a/...-aws-140-only_one_active_access_key_available_for_any_single_iam_user/iam/140-policy.json b/...-aws-140-only_one_active_access_key_available_for_any_single_iam_user/iam/140-policy.json
@@ -6,7 +6,8 @@
             "Action": [ 
                 "iam:ListAccessKeys",
                 "iam:GetUser",
-                "iam:ListAccessKeys"
+                "iam:ListAccessKeys",
+                "iam:ListUsers"
             ],
             "Resource": "*"
         }

diff --git a/terraform/ecc-aws-348-msk_encryption_in_transit_enabled/iam/348-policy.json b/terraform/ecc-aws-348-msk_encryption_in_transit_enabled/iam/348-policy.json
@@ -4,7 +4,7 @@
         {
             "Effect": "Allow",
             "Action": [
-                "kafka:ListClusters"
+                "kafka:ListClustersV2"
             ],
             "Resource": "*"
         }

diff --git a/terraform/ecc-aws-350-msk_logging_enabled/iam/350-policy.json b/terraform/ecc-aws-350-msk_logging_enabled/iam/350-policy.json
@@ -4,7 +4,7 @@
         {
             "Effect": "Allow",
             "Action": [
-                "kafka:ListClusters"
+                "kafka:ListClustersV2"
             ],
             "Resource": "*"
         }

diff --git a/terraform/ecc-aws-417-msk_clusters_without_tag_information/iam/417-policy.json b/terraform/ecc-aws-417-msk_clusters_without_tag_information/iam/417-policy.json
@@ -4,7 +4,7 @@
         {
             "Effect": "Allow",
             "Action": [
-                "kafka:ListClusters"
+                "kafka:ListClustersV2"
             ],
             "Resource": "*"
         }