A policy that grants all permissions may indicate an improper access control, which violates the principle of least privilege. Suppose an identity is granted full
permissions to a resource even though it only requires read permission to work as expected. In this case, an unintentional overwriting of resources
may occur and therefore result in loss of information.
Ask Yourself Whether
Identities obtaining all the permissions:
- only require a subset of these permissions to perform the intended function.
- have monitored activity showing that only a subset of these permissions is actually used.
There is a risk if you answered yes to any of those questions.
Recommended Secure Coding Practices
It’s recommended to apply the least privilege principle, i.e. by only granting the necessary permissions to identities. A good practice is to start
with the very minimum set of permissions and to refine the policy over time. In order to fix overly permissive policies already deployed in
production, a strategy could be to review the monitored activity in order to reduce the set of permissions to those most used.
Sensitive Code Example
A customer-managed policy for AWS that grants all permissions by using the wildcard (*) in the Action property:
resource "aws_iam_policy" "example" {
name = "noncompliantpolicy"
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Action = [
"*" # Sensitive
]
Effect = "Allow"
Resource = [
aws_s3_bucket.mybucket.arn
]
}
]
})
}
A customer-managed policy for GCP that grants all permissions by using the actions admin role role property:
resource "google_project_iam_binding" "example" {
project = "example"
role = "roles/owner" # Sensitive
members = [
"user:jane@example.com",
]
}
Compliant Solution
A customer-managed policy for AWS that grants only the required permissions:
resource "aws_iam_policy" "example" {
name = "compliantpolicy"
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Action = [
"s3:GetObject"
]
Effect = "Allow"
Resource = [
aws_s3_bucket.mybucket.arn
]
}
]
})
}
A customer-managed policy for GCP that grants restricted permissions by using the actions admin role role property:
resource "google_project_iam_binding" "example" {
project = "example"
role = "roles/actions.Viewer"
members = [
"user:jane@example.com",
]
}
See
