|
| 1 | +# This workflow uses actions that are not certified by GitHub. |
| 2 | +# They are provided by a third-party and are governed by |
| 3 | +# separate terms of service, privacy policy, and support |
| 4 | +# documentation. |
| 5 | + |
| 6 | +# This workflow will validate the IAM policies in the CloudFormation (CFN) templates with using the standard and custom checks in AWS IAM Access Analyzer |
| 7 | +# To use this workflow, you will need to complete the following set up steps before start using it: |
| 8 | +# 1. Configure an AWS IAM role to use the Access Analyzer's ValidatePolicy, CheckNoNewAccess and CheckAccessNotGranted. This IAM role must be configured to call from the GitHub Actions, use the following [doc](https://aws.amazon.com/blogs/security/use-iam-roles-to-connect-github-actions-to-actions-in-aws/) for steps. In the below workflow, ARN of such role is stored in the GitHub secrets with name `POLICY_VALIDATOR_ROLE` |
| 9 | +# 2. If you're using CHECK_NO_NEW_ACCESS policy-check-type, you need to create a reference policy. Use the guide [here](https://github.com/aws-samples/iam-access-analyzer-custom-policy-check-samples?tab=readme-ov-file#how-do-i-write-my-own-reference-policies) and store it your GitHub repo. |
| 10 | +# 3. If you're using the CHECK_ACCESS_NOT_GRANTED policy-check-type, identify the list of critical actions that shouldn't be granted access by the policies in the given CFN templates. |
| 11 | +# 4. Start using the GitHub actions by generating the GitHub events matching the defined criteria in your workflow. |
| 12 | +name: Validate AWS IAM policies in CloudFormation templates using Policy Validator |
| 13 | +on: |
| 14 | + push: |
| 15 | + branches: [$default-branch, $protected-branches] |
| 16 | + pull_request: |
| 17 | + # The branches below must be a subset of the branches above |
| 18 | + branches: [$default-branch] |
| 19 | +env: |
| 20 | + AWS_ROLE: MY_ROLE # set this with the role ARN which has permissions to invoke access-analyzer:ValidatePolicy,access-analyzer:CheckNoNewAccess, access-analyzer:CheckAccessNotGranted and can be used in GitHub actions |
| 21 | + REGION: MY_AWS_REGION # set this to your preferred AWS region where you plan to deploy your policies, e.g. us-west-1 |
| 22 | + TEMPLATE_PATH: FILE_PATH_TO_CFN_TEMPLATE # set to the file path to the CloudFormation template. |
| 23 | + ACTIONS: MY_LIST_OF_ACTIONS # set to pass list of actions in the format action1, action2,.. This is required if you are using `CHECK_ACCESS_NOT_GRANTED` policy-check-type. |
| 24 | + REFERENCE_POLICY: REFERENCE_POLICY # set to pass a JSON formatted file that specifies the path to the reference policy that is used for a permissions comparison. For example, if you stored such path in a GitHub secret with name REFERENCE_IDENTITY_POLICY , you can pass ${{ secrets.REFERENCE_IDENTITY_POLICY }}. If not you have the reference policy in the repository, you can directly pass it's file path. This is required if you are using `CHECK_NO_NEW_ACCESS_CHECK` policy-check-type. |
| 25 | + REFERENCE_POLICY_TYPE: TYPE_OF_REFERENCE_POLICY # set to pass the policy type associated with the IAM policy under analysis and the reference policy. This is required if you are using `CHECK_NO_NEW_ACCESS_CHECK` policy-check-type. |
| 26 | +jobs: |
| 27 | + policy-validator: |
| 28 | + runs-on: ubuntu-latest # Virtual machine to run the workflow (configurable) |
| 29 | + # https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#updating-your-github-actions-workflow |
| 30 | + # https://aws.amazon.com/blogs/security/use-iam-roles-to-connect-github-actions-to-actions-in-aws/ |
| 31 | + permissions: |
| 32 | + id-token: write # This is required for requesting the JWT |
| 33 | + contents: read # This is required for actions/checkout |
| 34 | + name: Policy Validator checks for AWS IAM policies |
| 35 | + steps: |
| 36 | + # checkout the repo for workflow to access the contents |
| 37 | + - name: Checkout |
| 38 | + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 |
| 39 | + # Configure AWS Credentials. More configuration details here - https://github.com/aws-actions/configure-aws-credentials |
| 40 | + - name: Configure AWS Credentials |
| 41 | + uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 |
| 42 | + with: |
| 43 | + role-to-assume: ${{ env.AWS_ROLE }} |
| 44 | + aws-region: ${{ env.REGION }} |
| 45 | + # Run the VALIDATE_POLICY check. More configuration details here - https://github.com/aws-actions/cloudformation-aws-iam-policy-validator |
| 46 | + - name: Run AWS AccessAnalyzer ValidatePolicy check |
| 47 | + id: run-aws-validate-policy |
| 48 | + uses: aws-actions/cloudformation-aws-iam-policy-validator@10479bdc0c8322ffb6f5eaa75d096195f97b798a #v1.0.0 |
| 49 | + with: |
| 50 | + policy-check-type: "VALIDATE_POLICY" |
| 51 | + template-path: ${{ env.TEMPLATE_PATH}} |
| 52 | + region: ${{ env.REGION }} |
| 53 | + # Print result from VALIDATE_POLICY check |
| 54 | + - name: Print the result for ValidatePolicy check |
| 55 | + if: success() || failure() |
| 56 | + run: echo "${{ steps.run-aws-validate-policy.outputs.result }}" |
| 57 | + # Run the CHECK_ACCESS_NOT_GRANTED check. More configuration details here - https://github.com/aws-actions/cloudformation-aws-iam-policy-validator |
| 58 | + - name: Run AWS AccessAnalyzer CheckAccessNotGranted check |
| 59 | + id: run-aws-check-access-not-granted |
| 60 | + uses: aws-actions/cloudformation-aws-iam-policy-validator@10479bdc0c8322ffb6f5eaa75d096195f97b798a #v1.0.0 |
| 61 | + with: |
| 62 | + policy-check-type: "CHECK_ACCESS_NOT_GRANTED" |
| 63 | + template-path: ${{ env.TEMPLATE_PATH}} |
| 64 | + actions: ${{ env.ACTIONS }} |
| 65 | + region: ${{ env.REGION }} |
| 66 | + # Print result from CHECK_ACCESS_NOT_GRANTED check |
| 67 | + - name: Print the result for CheckAccessNotGranted check |
| 68 | + if: success() || failure() |
| 69 | + run: echo "${{ steps.run-aws-check-access-not-granted.outputs.result }}" |
| 70 | + # Run the CHECK_NO_NEW_ACCESS check. More configuration details here - https://github.com/aws-actions/cloudformation-aws-iam-policy-validator |
| 71 | + # reference-policy is stored in GitHub secrets |
| 72 | + - name: Run AWS AccessAnalyzer CheckNoNewAccess check |
| 73 | + id: run-aws-check-no-new-access |
| 74 | + uses: aws-actions/cloudformation-aws-iam-policy-validator@10479bdc0c8322ffb6f5eaa75d096195f97b798a #v1.0.0 |
| 75 | + with: |
| 76 | + policy-check-type: "CHECK_NO_NEW_ACCESS" |
| 77 | + template-path: ${{ env.TEMPLATE_PATH}} |
| 78 | + reference-policy: ${{ env.REFERENCE }} |
| 79 | + reference-policy-type: ${{ env.REFERENCE_POLICY_TYPE }} |
| 80 | + region: ${{env.REGION }} |
| 81 | + # Print result from CHECK_NO_NEW_ACCESS check |
| 82 | + - name: Print the result for CheckNoNewAccess check |
| 83 | + if: success() || failure() |
| 84 | + run: echo "${{ steps.run-aws-check-no-new-access.outputs.result }}" |
0 commit comments