Scoutsuite: Potential AWS false-positives - 'Managed Policy Allows "iam:PassRole" For All Resources'

[LizardBlizzard]

The 'Managed Policy Allows "iam:PassRole" For All Resources' finding is triggered for Service-Linked Roles. These roles and their policies are created automatically and are not modifiable by the user. Although it is true that the policy is configured with "*" on the resource field, it does not seem to be under the user's control.

Moreover, the security threat is unclear in this case as an attacker will have to exploit the AWS service which assumes this Service-Linked Role to benefit from it. In that case, the role's permissions won't be the real concern.

If this is truly a false-positive, I think it may be possible to exclude "arn:aws:iam::aws:policy/aws-service-role/*" in the iam-managed-policy-for-role.json conditions.

To Reproduce
I think executing the script against any AWS environment will do, but if not, create an "Automatic Scaling Group" which will automatically assign the AutoScalingServiceRolePolicy to the service role.
python .\scout.py aws

[x4v13r64]

Thanks for raising this, it's indeed not a false positive as the management panel states:

This policy is linked to a service and used only with a service-linked role for that service. You cannot attach, detach, modify, or delete this policy.

This is only the case for policies with a arn:aws:iam::aws:policy/aws-service-role/ ARN though, not the ones with arn:aws:iam::aws:policy/service-role so we'll only exclude the former.

[x4v13r64]

Closing, this is fixed in https://github.com/nccgroup/ScoutSuite/pull/917.