id: iam-full-admin-privileges
info:
  name: Overly Permissive IAM Policies
  author: princechaddha
  severity: high
  description: |
    Verifies that no Amazon IAM policies grant full administrative privileges, ensuring adherence to the Principle of Least Privilege
  reference:
    - https://docs.aws.amazon.com/cli/latest/reference/iam/get-policy-version.html
  tags: cloud,devops,aws,amazon,iam,aws-cloud-config

flow: |
  code(1)
  for(let PolicyName of iterate(template.policies)){
    set("policy", PolicyName)
    code(2)
  }

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      aws iam list-policies --scope Local --query 'Policies[*].Arn'

    extractors:
      - type: json # type of the extractor
        internal: true
        name: policies
        json:
          - '.[]'

  - engine:
      - sh
      - bash
    source: |
         aws iam get-policy-version --policy-arn $policy --version-id v1 --query 'PolicyVersion.Document'

    matchers:
      - type: word
        words:
          - '"Effect": "Allow"'
          - '"Action": "*"'
          - '"Resource": "*"'
        condition: and

    extractors:
      - type: dsl
        dsl:
          - '"The IAM policy " + policy +" is Overly Permissive"'
# digest: 4a0a0047304502203eeeb24dbf1cfd3f41550e0c0b66bfb9ba23ea9912139aa2385e48b3a668d336022100dcb4c90fbb816ab247ea9d506497b900640b3d052bb2ce2b2f8b9a9e7fe58d9e:922c64590222798bb761d5b6d8e72950