data "aws_iam_policy_document" "AWSLambdaBasicExecutionRole-GTA_MyApps-Stage" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:us-east-1:619755864233:*"] actions = ["logs:CreateLogGroup"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:us-east-1:619755864233:log-group:/aws/lambda/GTA_MyApps-Stage:*"] actions = [ "logs:CreateLogStream", "logs:PutLogEvents", ] } } data "aws_iam_policy_document" "AWSLambdaS3ExecutionRole-ReadListPut_GTA_MyApps" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-gta-data-apps-stage/*", "arn:aws:s3:::sme-gta-data-apps-stage", ] actions = [ "s3:ListBucketByTags", "s3:GetLifecycleConfiguration", "s3:GetBucketTagging", "s3:GetInventoryConfiguration", "s3:GetObjectVersionTagging", "s3:ListBucketVersions", "s3:GetBucketLogging", "s3:ListBucket", "s3:GetAccelerateConfiguration", "s3:GetBucketPolicy", "s3:GetObjectVersionTorrent", "s3:GetObjectAcl", "s3:GetBucketRequestPayment", "s3:GetObjectVersionAcl", "s3:GetObjectTagging", "s3:GetMetricsConfiguration", "s3:GetIpConfiguration", "s3:ListBucketMultipartUploads", "s3:GetBucketWebsite", "s3:GetBucketVersioning", "s3:GetBucketAcl", "s3:GetBucketNotification", "s3:GetReplicationConfiguration", "s3:ListMultipartUploadParts", "s3:PutObject", "s3:GetObject", "s3:GetObjectTorrent", "s3:GetBucketCORS", "s3:GetAnalyticsConfiguration", "s3:GetObjectVersionForReplication", "s3:GetBucketLocation", "s3:GetObjectVersion", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "s3:ListAllMyBuckets", "s3:HeadBucket", "s3:ListObjects", ] } } data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1585141527700" { statement { sid = "AWSCloudTrailCreateLogStream20141101" effect = "Allow" resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:GSIRT-Monitoring-Trail-va:log-stream:${var.account_id}_CloudTrail_us-east-1*"] actions = ["logs:CreateLogStream"] } statement { sid = "AWSCloudTrailPutLogEvents20141101" effect = "Allow" resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:GSIRT-Monitoring-Trail-va:log-stream:${var.account_id}_CloudTrail_us-east-1*"] actions = ["logs:PutLogEvents"] } } data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-DescribePolicy" { statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:GetQueueUrl", "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:GetBucketTagging", "s3:GetAccelerateConfiguration", "s3:GetBucketLogging", "s3:GetLifecycleConfiguration", "s3:GetBucketCORS", "config:DeliverConfigSnapshot", "config:DescribeConfigRules", "config:DescribeConfigRuleEvaluationStatus", "config:GetComplianceDetailsByConfigRule", "config:GetComplianceSummaryByConfigRule", "iam:GetUser", "iam:ListUsers", "iam:GetAccountPasswordPolicy", "iam:ListAccessKeys", "iam:GetAccessKeyLastUsed", "autoscaling:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "sns:Get*", "sns:List*", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents", "ec2:DescribeInstances", "ec2:DescribeReservedInstances", "ec2:DescribeSnapshots", "ec2:DescribeRegions", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkAcls", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVpcs", "ec2:DescribeImages", "ec2:DescribeAddresses", "lambda:ListFunctions", "rds:DescribeDBInstances", "cloudfront:ListDistributions", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeListeners", "inspector:Describe*", "inspector:List*", "kinesis:DescribeStream", "kinesis:ListStreams", "eks:ListAddons", "eks:DescribeAddon", "eks:ListIdentityProviderConfigs", "eks:DescribeIdentityProviderConfig", "eks:DescribeAddonVersions", "eks:DescribeUpdate", "eks:ListTagsForResource", "network-firewall:ListTagsForResource", "logs:ListLogDeliveries", "logs:GetLogDelivery", ] } } data "aws_iam_policy_document" "dadcp-aws-config-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-dadc-mps-prod-awsconfig/*"] actions = ["s3:PutObject*"] condition { test = "StringLike" variable = "s3:x-amz-acl" values = ["bucket-owner-full-control"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-dadc-mps-prod-awsconfig"] actions = ["s3:GetBucketAcl"] } } data "aws_iam_policy_document" "sme-dx3d-thecus" { statement { sid = "Stmt1568729080000" effect = "Allow" resources = [ "arn:aws:s3:::sme-dx3d-thecus-ff", "arn:aws:s3:::sme-dx3d-thecus-va", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "s3crr_for_sme-dx3d-thecus-ff_to_sme-dx3d-thecus-va" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::sme-dx3d-thecus-ff", "arn:aws:s3:::sme-dx3d-thecus-ff/*", ] actions = [ "s3:Get*", "s3:ListBucket", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-dx3d-thecus-va/*"] actions = [ "s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags", "s3:GetObjectVersionTagging", ] } } data "aws_iam_policy_document" "cloudops-BudgetActionDenyPolicy" { statement { sid = "VisualEditor0" effect = "Deny" resources = ["*"] actions = [ "s3:CreateAccessPoint", "s3:CreateBucket", "s3:CreateJob", "ec2:RunInstances", "ec2:RunScheduledInstances", "ec2:CreateVolume", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "es:CreateElasticsearchDomain", "es:CreateElasticsearchServiceRole", "es:CreateOutboundCrossClusterSearchConnection", "es:UpdateElasticsearchDomainConfig", "es:UpgradeElasticsearchDomain", "rds:CreateDBCluster", "rds:CreateDBClusterEndpoint", "rds:CreateDBClusterParameterGroup", "rds:CreateDBClusterSnapshot", "rds:CreateDBInstance", "rds:CreateDBInstanceReadReplica", "rds:CreateDBParameterGroup", "rds:CreateDBProxy", "rds:CreateDBSnapshot", "rds:CreateGlobalCluster", "kafka:CreateCluster", "kafka:CreateConfiguration", "eks:CreateCluster", "eks:CreateFargateProfile", "eks:CreateNodegroup", "ecs:CreateCapacityProvider", "ecs:CreateCluster", "ecs:CreateService", "ecs:CreateTaskSet", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:CreateAccessPoint", "elasticfilesystem:UpdateFileSystem", "fsx:CreateBackup", "fsx:CreateDataRepositoryTask", "fsx:CreateFileSystem", "fsx:CreateFileSystemFromBackup", "workspaces:CreateIpGroup", "workspaces:CreateWorkspaces", "redshift:CreateCluster", "redshift:CreateClusterParameterGroup", "redshift:CreateClusterSecurityGroup", "redshift:CreateClusterSnapshot", ] } } data "aws_iam_policy_document" "trial-1" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:UntagResource", "secretsmanager:DescribeSecret", "secretsmanager:DeleteResourcePolicy", "secretsmanager:PutSecretValue", "secretsmanager:ListSecretVersionIds", "secretsmanager:UpdateSecret", "secretsmanager:GetRandomPassword", "secretsmanager:GetResourcePolicy", "secretsmanager:GetSecretValue", "secretsmanager:PutResourcePolicy", "secretsmanager:RestoreSecret", "secretsmanager:RotateSecret", "secretsmanager:ValidateResourcePolicy", "secretsmanager:ListSecrets", "secretsmanager:TagResource", ] } } data "aws_iam_policy_document" "Billing" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "account:GetAccountInformation", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:ValidateReportDestination", "cur:GetUsageReport", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentMethods", "payments:ListPaymentPreferences", "tax:GetTaxInheritance", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", ] } } data "aws_iam_policy_document" "RDSProxyIAMPolicy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/8279f421-b5be-4842-afce-94c04860a49b"] actions = ["kms:Decrypt*"] condition { test = "StringEquals" variable = "kms:ViaService" values = ["secretsmanager.eu-central-1.amazonaws.com"] } } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:GetRandomPassword", "secretsmanager:GetResourcePolicy", "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds", "secretsmanager:ListSecrets", "secretsmanager:createsecret", "iam:passrole", "kms:*", ] } } data "aws_iam_policy_document" "sme-gen-custom" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "lambda:CreateFunction", "lambda:AddPermission", "cloudwatch:PutMetricData", "ds:CreateComputer", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "ec2:DeleteVolume", "logs:CreateLogStream", "ec2:StartInstances", "lambda:DeleteFunction", "ecs:DeregisterContainerInstance", "ecr:BatchCheckLayerAvailability", "lambda:InvokeFunction", "ecs:CreateCluster", "config:PutConfigRule", "ecr:GetDownloadUrlForLayer", "config:PutEvaluations", "ec2messages:AcknowledgeMessage", "ecr:GetAuthorizationToken", "ec2:StopInstances", "logs:CreateLogGroup", "config:StartConfigRulesEvaluation", "rds:StartDBInstance", "lambda:UpdateFunctionCode", "ecs:StartTelemetrySession", "config:PutConfigurationAggregator", "ecr:BatchGetImage", "lambda:PublishVersion", "ec2messages:SendReply", "ce:*", "ec2:DeleteSnapshot", "ec2messages:GetEndpoint", "logs:DescribeLogStreams", "ecs:RegisterContainerInstance", "ecs:Submit*", "ec2messages:GetMessages", "ecs:Poll", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2:CreateSnapshot", "ec2:DescribeInstanceStatus", "config:PutConfigurationRecorder", "ecs:DiscoverPollEndpoint", "logs:DescribeLogGroups", "lambda:UpdateFunctionConfiguration", "config:StopConfigurationRecorder", "config:PutAggregationAuthorization", "rds:StopDBInstance", "logs:PutLogEvents", "support:*", "config:PutRetentionConfiguration", "ds:DescribeDirectories", "ssm:*", ] } } data "aws_iam_policy_document" "cost-explore-ro" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ce:DescribeCostCategoryDefinition", "ce:GetRightsizingRecommendation", "ce:GetCostAndUsage", "ce:GetSavingsPlansUtilization", "ce:GetReservationPurchaseRecommendation", "ce:ListCostCategoryDefinitions", "ce:GetCostForecast", "ce:GetReservationUtilization", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetDimensionValues", "ce:GetSavingsPlansUtilizationDetails", "ce:GetCostAndUsageWithResources", "ce:GetReservationCoverage", "ce:GetSavingsPlansCoverage", "ce:GetTags", "ce:GetUsageForecast", ] } } data "aws_iam_policy_document" "DeepSecurity-7a5351f4c" { statement { sid = "1" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeRegions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListAccountAliases", ] } statement { sid = "2" effect = "Allow" resources = ["arn:aws:iam::*:role/DeepSecurity-7a5351f4c"] actions = [ "iam:GetRole", "iam:GetRolePolicy", ] } statement { sid = "3" effect = "Allow" resources = ["*"] actions = [ "workspaces:DescribeWorkspaces", "workspaces:DescribeWorkspaceDirectories", "workspaces:DescribeWorkspaceBundles", "workspaces:DescribeTags", ] } } data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1503413823468" { statement { sid = "AWSCloudTrailCreateLogStream20141101" effect = "Allow" resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_us-east-1*"] actions = ["logs:CreateLogStream"] } statement { sid = "AWSCloudTrailPutLogEvents20141101" effect = "Allow" resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_us-east-1*"] actions = ["logs:PutLogEvents"] } } data "aws_iam_policy_document" "dx3d-dev" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::*"] actions = ["s3:ListAllMyBuckets"] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::sme-dx3d-dx3", "arn:aws:s3:::sme-stage-origin-dx3", "arn:aws:s3:::sme-dx3d-dx3/*", "arn:aws:s3:::sme-stage-origin-dx3/*", ] actions = [ "s3:CreateAccessPoint", "s3:PutAnalyticsConfiguration", "s3:PutAccelerateConfiguration", "s3:PutAccessPointConfigurationForObjectLambda", "s3:DeleteObjectVersion", "s3:RestoreObject", "s3:DeleteAccessPoint", "s3:CreateBucket", "s3:DeleteAccessPointForObjectLambda", "s3:ReplicateObject", "s3:PutEncryptionConfiguration", "s3:DeleteBucketWebsite", "s3:AbortMultipartUpload", "s3:DeleteBucketOwnershipControls", "s3:PutLifecycleConfiguration", "s3:UpdateJobPriority", "s3:DeleteObject", "s3:DeleteBucket", "s3:PutBucketVersioning", "s3:PutIntelligentTieringConfiguration", "s3:PutMetricsConfiguration", "s3:PutBucketOwnershipControls", "s3:PutReplicationConfiguration", "s3:PutObjectLegalHold", "s3:UpdateJobStatus", "s3:PutBucketCORS", "s3:PutInventoryConfiguration", "s3:PutObject", "s3:PutBucketNotification", "s3:DeleteStorageLensConfiguration", "s3:PutBucketWebsite", "s3:PutBucketRequestPayment", "s3:PutObjectRetention", "s3:PutBucketLogging", "s3:CreateAccessPointForObjectLambda", "s3:PutBucketObjectLockConfiguration", "s3:ReplicateDelete", ] } } data "aws_iam_policy_document" "ssm-sec-agent-status-upload" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ssm:UpdateInstanceInformation", "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel", "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::portal-agents-amazon-ssm-packages-command", "arn:aws:s3:::portal-agents-amazon-ssm-packages-command/*", ] actions = [ "s3:GetBucketLocation", "s3:PutObject", "s3:GetObject", "s3:GetEncryptionConfiguration", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts", "s3:ListBucket", "s3:ListBucketMultipartUploads", ] } } data "aws_iam_policy_document" "CWLogs-Put" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["logs:PutLogEvents"] } } data "aws_iam_policy_document" "AWS_Allow_Inspector_Assessment" { statement { sid = "" effect = "Allow" resources = ["*"] actions = ["inspector:StartAssessmentRun"] } } data "aws_iam_policy_document" "oneClick_flowlogsRole_1452260652014" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents", ] } } data "aws_iam_policy_document" "root" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:iam::*:role/DeepSecurity-7a5351f4c*"] actions = [ "iam:GetRole", "iam:GetRolePolicy", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeRegions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListAccountAliases", ] } } data "aws_iam_policy_document" "dxdevelopers" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "rds:*", "s3:*", "apigateway:*", "cloudtrail:*", "elasticloadbalancing:*", "autoscaling:*", "sqs:*", "mobiletargeting:*", "cloudfront:*", "secretsmanager:*", "lambda:*", "ec2:*", "ecr:*", ] } } data "aws_iam_policy_document" "sme-dx3d-origin" { statement { sid = "Stmt1568729080000" effect = "Allow" resources = [ "arn:aws:s3:::sme-dx3d-dx3", "arn:aws:s3:::sme-dx3d-dx3/*", "arn:aws:s3:::sme-stage-origin-dx3", "arn:aws:s3:::sme-stage-origin-dx3/*", "arn:aws:s3:::sme-dx3p-dx3", "arn:aws:s3:::sme-dx3p-dx3/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "sme-dx3d-dx3-s3-access" { statement { sid = "AllowListingStageDxFolder" effect = "Allow" actions = [ "s3:ListBucket" ] resources = [ "arn:aws:s3:::sme-dx3d-dx3" ] condition { test = "StringLike" variable = "s3:prefix" values = ["stage-dx/*"] } } statement { sid = "AllowAllActionsOnStageDxObjects" effect = "Allow" actions = [ "s3:*" ] resources = [ "arn:aws:s3:::sme-dx3d-dx3/stage-dx/*" ] } } data "aws_iam_policy_document" "dadcp-portal-policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "waf:ListWebACLs", "ssm:SendCommand", "wafv2:ListRuleGroups", "iam:DeleteAccessKey", "ec2:DescribeInstances", "waf:ListRateBasedRules", "s3:Get*", "wafv2:ListLoggingConfigurations", "wafv2:ListIPSets", "ec2:DescribeSnapshots", "s3:List*", "ec2:CreateRoute", "ec2:DescribeVolumes", "config:DescribeConfigRules", "lambda:DeleteFunction", "iam:GetCredentialReport", "ec2:DescribeKeyPairs", "budgets:UpdateBudgetAction", "iam:ListPolicies", "waf-regional:ListWebACLs", "iam:GetRole", "cloudtrail:LookupEvents", "waf:ListSqlInjectionMatchSets", "lambda:ListFunctions", "ec2:CreateTags", "iam:ListEntitiesForPolicy", "waf-regional:ListIPSets", "kafka:DescribeCluster", "cloudwatch:GetMetricStatistics", "waf-regional:ListRules", "cloudtrail:DescribeTrails", "waf:ListGeoMatchSets", "elasticloadbalancing:AddTags", "inspector:ListFindings", "eks:ListClusters", "ec2:DescribeSubnets", "glacier:ListVaults", "ec2:ModifyVpcEndpoint", "iam:GenerateCredentialReport", "waf:ListByteMatchSets", "waf-regional:ListLoggingConfigurations", "ssm:DescribePatchGroups", "wafv2:ListWebACLs", "s3:GetBucketTagging", "ec2:DescribeFlowLogs", "ce:GetCostAndUsage", "kms:ListResourceTags", "wafv2:ListAvailableManagedRuleGroups", "waf-regional:ListRateBasedRules", "waf:ListActivatedRulesInRuleGroup", "iam:PassRole", "waf-regional:ListResourcesForWebACL", "s3:AbortMultipartUpload", "s3:PutBucketTagging", "ssm:DescribeInstancePatchStatesForPatchGroup", "ec2:CreateSnapshot", "rds:DescribeDBInstances", "iam:ListAttachedGroupPolicies", "es:DescribeElasticsearchDomains", "iam:ListAccessKeys", "rds:AddTagsToResource", "ec2:ReleaseAddress", "wafv2:ListResourcesForWebACL", "inspector:ListAssessmentTargets", "s3:ListBucketMultipartUploads", "waf:ListIPSets", "iam:ListGroupPolicies", "route53:ListHostedZones", "lambda:UpdateFunctionConfiguration", "iam:ListRoles", "waf-regional:ListGeoMatchSets", "es:DescribeElasticsearchDomainConfig", "inspector:ListAssessmentRuns", "waf-regional:ListActivatedRulesInRuleGroup", "ec2:DescribeSecurityGroups", "budgets:CreateBudgetAction", "es:ListDomainNames", "rds:ListTagsForResource", "ec2:DescribeVpcs", "kms:ListAliases", "iam:ListAccountAliases", "elasticloadbalancing:DescribeTargetGroups", "iam:ListGroups", "waf:ListRules", "budgets:ModifyBudget", "iam:UpdateAssumeRolePolicy", "iam:GetPolicyVersion", "ssm:DescribeInstancePatches", "ec2:DescribeInternetGateways", "wafv2:ListRegexPatternSets", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DeleteVolume", "wafv2:DescribeManagedRuleGroup", "waf-regional:ListRegexMatchSets", "iam:ListAttachedRolePolicies", "elasticloadbalancing:DescribeLoadBalancerPolicies", "route53:ListResourceRecordSets", "ec2:DescribeReservedInstances", "apigateway:GET", "trustedadvisor:Describe*", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "waf:ListSubscribedRuleGroups", "waf-regional:ListRegexPatternSets", "rds:DescribeDBSnapshots", "glacier:ListTagsForVault", "ec2:DescribeVpnConnections", "ec2:DescribeVpcPeeringConnections", "iam:GetAccessKeyLastUsed", "ec2:CreateRouteTable", "iam:UpdateAccessKey", "waf:ListSizeConstraintSets", "s3:ListMultipartUploadParts", "ecs:DescribeClusters", "elasticloadbalancing:DescribeLoadBalancerAttributes", "acm:DescribeCertificate", "s3:PutBucketLogging", "iam:ListGroupsForUser", "eks:DescribeCluster", "ec2:DescribeVpcEndpoints", "waf-regional:ListSqlInjectionMatchSets", "waf:ListRegexPatternSets", "elasticache:DescribeCacheClusters", "waf-regional:ListXssMatchSets", "ec2:DescribeVpnGateways", "iam:GetAccountSummary", "ec2:DeleteSnapshot", "ec2:DescribeAddresses", "kafka:ListClusters", "ec2:DescribeInstanceAttribute", "s3:GetBucketLogging", "iam:ListMFADevices", "iam:CreateAccessKey", "s3:PutEncryptionConfiguration", "s3:GetEncryptionConfiguration", "directconnect:DescribeVirtualInterfaces", "elasticloadbalancing:DescribeListeners", "ec2:DescribeNetworkInterfaces", "es:DescribeElasticsearchDomain", "wafv2:*", "iam:ListAttachedUserPolicies", "kms:DescribeKey", "acm:ListCertificates", "waf-regional:ListRuleGroups", "elasticfilesystem:DescribeFileSystems", "health:DescribeEvents", "inspector:DescribeFindings", "ecs:ListClusters", "waf:ListRegexMatchSets", "sqs:ListQueues", "s3:PutBucketPublicAccessBlock", "waf:ListRuleGroups", "elasticloadbalancing:DescribeTags", "waf-regional:ListSizeConstraintSets", "waf-regional:ListByteMatchSets", "iam:ListUserPolicies", "ec2:DescribeNatGateways", "ec2:DescribeCustomerGateways", "support:*", "ec2:DescribeImages", "waf:ListLoggingConfigurations", "waf:ListXssMatchSets", "elasticloadbalancing:DescribeTargetHealth", "cloudfront:ListDistributions", "redshift:DescribeClusters", "iam:ListUsers", "waf-regional:ListSubscribedRuleGroups", "s3:GetBucketLocation", "iam:ListUserTags", "elasticmapreduce:ListClusters", "ssm:SendCommand", "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation", ] } } data "aws_iam_policy_document" "cloudops-instance-policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "autoscaling:Describe*", "autoscaling:Describe*", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListPublicKeys", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:GetMetricStatistics", "cloudwatch:List*", "cloudwatch:ListMetrics", "cloudwatch:PutMetricData", "ec2:Describe*", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInternetGateways", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply", "elasticloadbalancing:Describe*", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:Describe*", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:FilterLogEvents", "logs:Get*", "logs:GetLogEvents", "logs:List*", "logs:PutLogEvents", "logs:TestMetricFilter", "rds:Describe*", "rds:ListTagsForResource", "s3:Get*", "s3:GetBucketLocation", "s3:GetObject", "s3:List*", "s3:ListAllMyBuckets", "sns:Get*", "sns:List*", "ssm:DescribeAssociation", "ssm:DescribeDocument", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:GetDocument", "ssm:GetManifest", "ssm:GetParameter", "ssm:GetParameters", "ssm:ListAssociations", "ssm:ListInstanceAssociations", "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel", "ssm:PutComplianceItems", "ssm:PutConfigurePackageResult", "ssm:PutInventory", "ssm:UpdateAssociationStatus", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateInstanceInformation", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"] actions = [ "ssm:GetParameter", "ssm:PutParameter", ] } } data "aws_iam_policy_document" "s3-central-ansible" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:CreateJob", "s3:HeadBucket", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:s3:::central-ansible"] actions = ["s3:*"] } } data "aws_iam_policy_document" "lambda_elasticsearch_execution_policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:es:*:*:*"] actions = ["es:ESHttpPost"] } } data "aws_iam_policy_document" "sme-dadc-mps-prod-config-role-us-east-1_AWSConfigDeliveryPermissions_us-east-1" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-dadc-mps-prod-awsconfig/AWSLogs/${var.account_id}/*"] actions = ["s3:PutObject*"] condition { test = "StringLike" variable = "s3:x-amz-acl" values = ["bucket-owner-full-control"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-dadc-mps-prod-awsconfig"] actions = ["s3:GetBucketAcl"] } } data "aws_iam_policy_document" "ResourceTags-CreatePermission" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration statement { sid = "Stmt1479388154691" effect = "Allow" resources = ["*"] actions = [ "ec2:CreateTags", "ec2:Describe*", ] } statement { sid = "Stmt1479388220241" effect = "Allow" resources = ["*"] actions = [ "s3:Get*", "s3:PutBucketTagging", ] } statement { sid = "Stmt1479388250270" effect = "Allow" resources = ["*"] actions = [ "rds:AddTagsToResource", "rds:Describe*", ] } statement { sid = "Stmt1479388274620" effect = "Allow" resources = ["*"] actions = [ "redshift:CreateTags", "redshift:Describe*", ] } } data "aws_iam_policy_document" "SendRawEmail" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = ["ses:SendRawEmail"] } } data "aws_iam_policy_document" "GLACIER-ARCHIVE-MPS" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme.mps.archives"] actions = ["s3:ListAllMyBuckets"] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::sme.mps.archives", "arn:aws:s3:::sme.mps.archives/*", ] actions = [ "s3:List*", "s3:Get*", ] } } data "aws_iam_policy_document" "mpsprodbucket" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::sme-mps-prod", "arn:aws:s3:::sme-mps-prod/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "CloudOpsDenyIAM" { statement { sid = "VisualEditor0" effect = "Deny" resources = ["*"] actions = [ "iam:UpdateAssumeRolePolicy", "iam:DeactivateMFADevice", "iam:CreateServiceSpecificCredential", "iam:DeleteAccessKey", "iam:DeleteGroup", "iam:UpdateOpenIDConnectProviderThumbprint", "iam:RemoveRoleFromInstanceProfile", "iam:UpdateGroup", "iam:CreateRole", "iam:AttachRolePolicy", "iam:PutRolePolicy", "iam:AddRoleToInstanceProfile", "iam:CreateLoginProfile", "iam:DetachRolePolicy", "iam:CreateAccountAlias", "iam:DeleteServerCertificate", "iam:UploadSSHPublicKey", "iam:DetachGroupPolicy", "iam:DetachUserPolicy", "iam:DeleteOpenIDConnectProvider", "iam:ChangePassword", "iam:PutGroupPolicy", "iam:UpdateLoginProfile", "iam:UpdateServiceSpecificCredential", "iam:CreateGroup", "iam:RemoveClientIDFromOpenIDConnectProvider", "iam:UpdateUser", "iam:DeleteUserPolicy", "iam:AttachUserPolicy", "iam:DeleteRole", "iam:UpdateRoleDescription", "iam:UpdateAccessKey", "iam:UpdateSSHPublicKey", "iam:UpdateServerCertificate", "iam:DeleteSigningCertificate", "iam:UpdateAccountPasswordPolicy", "iam:DeleteServiceLinkedRole", "iam:CreateInstanceProfile", "iam:UntagRole", "iam:PutRolePermissionsBoundary", "iam:TagRole", "iam:ResetServiceSpecificCredential", "iam:DeletePolicy", "iam:DeleteSSHPublicKey", "iam:CreateVirtualMFADevice", "iam:CreateSAMLProvider", "iam:DeleteRolePermissionsBoundary", "iam:CreateUser", "iam:CreateAccessKey", "iam:AddUserToGroup", "iam:RemoveUserFromGroup", "iam:DeleteRolePolicy", "iam:EnableMFADevice", "iam:ResyncMFADevice", "iam:DeleteAccountAlias", "iam:CreatePolicyVersion", "iam:UpdateSAMLProvider", "iam:DeleteLoginProfile", "iam:DeleteInstanceProfile", "iam:UploadSigningCertificate", "iam:DeleteAccountPasswordPolicy", "iam:PutUserPermissionsBoundary", "iam:DeleteUser", "iam:DeleteUserPermissionsBoundary", "iam:TagUser", "iam:CreateOpenIDConnectProvider", "iam:UploadServerCertificate", "iam:CreatePolicy", "iam:UntagUser", "iam:CreateServiceLinkedRole", "iam:DeleteVirtualMFADevice", "iam:AttachGroupPolicy", "iam:PutUserPolicy", "iam:UpdateRole", "iam:UpdateSigningCertificate", "iam:DeleteGroupPolicy", "iam:AddClientIDToOpenIDConnectProvider", "iam:DeleteServiceSpecificCredential", "iam:DeletePolicyVersion", "iam:SetDefaultPolicyVersion", "iam:DeleteSAMLProvider", ] } } data "aws_iam_policy_document" "GSIRT_AWS_S3AccessLog_Collection" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:sqs:us-east-1:${var.account_id}:dadcmpsp-LBAccessLogs-va", "arn:aws:sqs:us-east-1:${var.account_id}:dadcmpsp-S3AccessLogs-va", "arn:aws:s3:::awseb-e-2-awsebloa-1892ekz6bd6uk/*", "arn:aws:s3:::awseb-e-2-awsebloa-1892ekz6bd6uk/", "arn:aws:s3:::sme-dadc-mps-prod-us-east-1-logs/*", "arn:aws:s3:::sme-dadc-mps-prod-us-east-1-logs/", ] actions = [ "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage", "sqs:DeleteMessage", "sqs:ChangeMessageVisibility", "sqs:GetQueueAttributes", "sqs:ListQueues", "s3:GetObject", "s3:GetObjectVersion", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["sqs:ListQueues"] } } data "aws_iam_policy_document" "s3cp" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::ben-emr-test", "arn:aws:s3:::ben-emr-test/*", "arn:aws:s3:::ben-emr-test-gmp", "arn:aws:s3:::ben-emr-test-gmp/*", "arn:aws:s3:::mps_dev", "arn:aws:s3:::mps_dev/*", "arn:aws:s3:::sme-mps-dev", "arn:aws:s3:::sme-mps-dev/*", "arn:aws:s3:::mps_prod", "arn:aws:s3:::mps_prod/*", "arn:aws:s3:::sme-mps-prod", "arn:aws:s3:::sme-mps-prod/*", "arn:aws:s3:::mps_stage", "arn:aws:s3:::mps_stage/*", "arn:aws:s3:::sme-mps-stage", "arn:aws:s3:::sme-mps-stage/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "mpsstagebucket" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::sme-mps-stage", "arn:aws:s3:::sme-mps-stage/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "atlantis_terrastate_policy" { statement { actions = [ "s3:GetObject", "s3:PutObject", ] resources = [ "arn:aws:s3:::${var.terrastate_bucket}/*", ] } statement { actions = [ "s3:ListBucket", ] resources = [ "arn:aws:s3:::${var.terrastate_bucket}", ] } } data "aws_iam_policy_document" "ecr_full_access" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" actions = ["ecr:*"] resources = ["*"] } } data "aws_iam_policy_document" "ecs_task_exec_secrets" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:*" ] actions = [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ] } } data "aws_iam_policy_document" "dsms_task_assume" { statement { effect = "Allow" actions = ["sts:AssumeRole"] principals { type = "Service" identifiers = ["ecs-tasks.amazonaws.com"] } } } data "aws_iam_policy_document" "csa_task_assume" { statement { effect = "Allow" actions = ["sts:AssumeRole"] principals { type = "Service" identifiers = ["ecs-tasks.amazonaws.com"] } } } data "aws_iam_policy_document" "atlantis_secrets_read_policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { actions = [ "secretsmanager:GetSecretValue", "kms:Decrypt" ] resources = [ "*", ] } } data "aws_iam_policy_document" "atlantis_tf_infra_core_apply_policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure statement { actions = [ "acm:*", "airflow:*", "apigateway:*", "application-autoscaling:*", "athena:*", "autoscaling:*", "batch:*", "backup:*", "backup-storage:*", "cloudfront:*", "cloudformation:*", "cloudwatch:*", "config:*", "cloudtrail:*", "ce:Get*", "ce:List*", "ce:*AnomalyMonitor", "ce:*AnomalySubscription", "ce:TagResource", "cur:*", "dlm:*", "dynamodb:*", "ec2:*VpcEndpoint*", "ec2:AcceptTransitGatewayVpcAttachment", "ec2:AllocateAddress", "ec2:AssociateRouteTable", "ec2:AssociateTransitGatewayRouteTable", "ec2:AttachInternetGateway", "ec2:Authorize*", "ec2:CancelCapacityReservation*", "ec2:Create*", "ec2:*NetworkInterface*", "ec2:Delete*", "ec2:Describe*", "ec2:Get*", "ec2:Modify*", "ec2:Monitor*", "ec2:ReplaceNetworkAclAssociation", "ec2:Revoke*", "ec2:RunInstances", "ec2:Search*", "ec2:Update*", "ecr:*", "ecs:Create*", "ecs:Delete*", "ecs:Deregister*", "ecs:Describe*", "ecs:DiscoverPollEndpoint", "ecs:List*", "ecs:Poll", "ecs:PutClusterCapacityProviders", "ecs:Register*", "ecs:RunTask", "ecs:Start*", "ecs:StopTask", "ecs:Submit*", "ecs:TagResource", "ecs:UntagResource", "ecs:Update*", "elasticache:*", "elasticfilesystem:*", "elasticloadbalancing:*", "elasticmapreduce:*", "es:*", "events:*", "firehose:*", "geo:*", "glue:*", "guardduty:*", "iam:Add*", "iam:Attach*", "iam:Create*", "iam:Delete*", "iam:Detach*", "iam:Get*", "iam:List*", "iam:PassRole", "iam:PutRolePolicy", "iam:PutRolePermissionsBoundary", "iam:Remove*", "iam:Tag*", "iam:Untag*", "iam:Update*", "kafka:*", "kafkaconnect:*", "kinesis:*", "kms:*", "lakeformation:*", "lambda:Add*", "lambda:Create*", "lambda:Delete*", "lambda:Get*", "lambda:List*", "lambda:PublishVersion", "lambda:PutFunctionConcurrency", "lambda:RemovePermission", "lambda:TagResource", "lambda:UntagResource", "lambda:Update*", "logs:*", "networkmanager:Get*", "networkmanager:Describe*", "ram:AssociateResourceShare", "ram:CreateResourceShare", "ram:DeleteResourceShare", "ram:DisassociateResourceShare", "ram:Get*", "ram:List*", "ram:TagResource", "route53resolver:*", "rds:Add*", "rds:CreateDB*", "rds:CreateEventSubscription", "rds:DeleteDB*", "rds:DeleteEventSubscription", "rds:ModifyDB*", "rds:PurchaseReservedDBInstancesOffering", "rds:RegisterDBProxyTargets", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:RestoreDBClusterFromSnapshot", "rds:Describe*", "rds:List*", "resource-explorer-2:*", "route53:*", "route53profiles:*", "s3:*", "secretsmanager:*", "ses:*", "servicequotas:*", "sns:*", "scheduler:*", "sqs:*", "ssm:*", "storagegateway:*", "states:*", "waf:Get*", "waf:List*", "wafv2:AssociateWebACL", "wafv2:CreateIPSet", "wafv2:CreateRuleGroup", "wafv2:CreateWebACL", "wafv2:DeleteIPSet", "wafv2:DeleteLoggingConfiguration", "wafv2:DeleteRuleGroup", "wafv2:DeleteWebACL", "wafv2:Get*", "wafv2:List*", "wafv2:PutLoggingConfiguration", "wafv2:TagResource", "wafv2:UntagResource", "wafv2:UpdateIPSet", "wafv2:UpdateRuleGroup", "wafv2:UpdateWebACL", ] resources = [ "*", ] } } data "aws_iam_policy_document" "atlantis_apply_policy_part_one" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure statement { actions = [ "acm:AddTagsToCertificate", "acm:Describe*", "acm:Get*", "acm:List*", "acm:RenewCertificate", "acm:RequestCertificate", "acm:UpdateCertificateOptions", "airflow:CreateEnvironment", "airflow:DeleteEnvironment", "airflow:Get*", "airflow:List*", "airflow:ListEnvironments", "airflow:ListTagsForResource", "airflow:PublishMetrics", "airflow:TagResource", "airflow:UpdateEnvironment", "application-autoscaling:*", "athena:*", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateOrUpdateTags", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteScheduledAction", "autoscaling:Describe*", "autoscaling:EnableMetricsCollection", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:SuspendProcesses", "autoscaling:UpdateAutoScalingGroup", "batch:*ComputeEnvironment", "batch:*JobQueue", "batch:*JobDefinition", "batch:Describe*", "batch:TagResource", "batch:UntagResource", "backup:*", "backup-storage:*", "apigateway:*", "cloudfront:*", "cloudformation:*", "cloudwatch:*", "config:*", "cloudsearch:AddTags", "cloudsearch:CreateDomain", "cloudsearch:Define*", "cloudsearch:Delete*", "cloudsearch:Describe*", "cloudsearch:IndexDocuments", "cloudsearch:List*", "cloudsearch:RemoveTags", "cloudsearch:Update*", "cloudtrail:*", "dlm:*", "dynamodb:*", "ec2:*VpcEndpoint*", "ec2:AttachVolume", "ec2:AuthorizeSecurityGroup*", "ec2:CancelCapacityReservation*", "ec2:CreateCapacityReservation*", "ec2:CreateLaunchTemplate*", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:CreateVolume", "ec2:DeleteLaunchTemplate*", "ec2:DeleteSecurityGroup", "ec2:DeleteTags", "ec2:Describe*", "ec2:Get*", "ec2:ModifyCapacityReservation", "ec2:ModifyCapacityReservationFleet", "ec2:ModifyInstanceAttribute", "ec2:ModifyInstanceCapacityReservationAttributes", "ec2:ModifyLaunchTemplate", "ec2:ModifyVolume", "ec2:MonitorInstances", "ec2:RevokeSecurityGroup*", "ec2:RunInstances", "ec2:SearchTransitGateway*", "ec2:UpdateSecurityGroupRuleDescriptions*", "ecr:*", "ecs:Create*", "ecs:DeleteCluster", "ecs:DeleteService", "ecs:DeleteTaskSet", "ecs:Deregister*", "ecs:Describe*", "ecs:DiscoverPollEndpoint", "ecs:List*", "ecs:Poll", "ecs:PutClusterCapacityProviders", "ecs:Register*", "ecs:RunTask", "ecs:StartTask", "ecs:StartTelemetrySession", "ecs:StopTask", "ecs:SubmitContainerStateChange", "ecs:SubmitTaskStateChange", "ecs:TagResource", "ecs:UntagResource", "ecs:Update*", "elasticache:*", "elasticbeanstalk:UpdateEnvironment", "elasticbeanstalk:UpdateEnvironment", "elasticfilesystem:*", "elasticloadbalancing:*", "elasticmapreduce:*", "elastictranscoder:Read*", "elastictranscoder:List*", "es:*", "events:CreateApiDestination", "events:CreateConnection", "events:CreateEventBus", "events:DeleteApiDestination", "events:DeleteConnection", "events:DeleteEventBus", "events:DeleteRule", "events:Describe*", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:TagResource", "events:UpdateApiDestination", "events:UpdateConnection", "events:List*", "events:UntagResource", "firehose:CreateDeliveryStream", "firehose:DeleteDeliveryStream", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "firehose:TagDeliveryStream", "firehose:UntagDeliveryStream", "firehose:UpdateDestination", "geo:*", "glue:*", "guardduty:CreateMalwareProtectionPlan", "guardduty:GetMalwareProtectionPlan", "guardduty:ListTagsForResource", "guardduty:TagResource", "iam:AddRoleToInstanceProfile", "iam:AddUserToGroup", "iam:Attach*", "iam:CreateGroup", "iam:CreateInstanceProfile", "iam:CreatePolicy", "iam:CreatePolicyVersion", "iam:CreateRole", "iam:CreateServiceLinkedRole", "iam:CreateUser", "iam:DeleteGroup", "iam:DeleteInstanceProfile", "iam:DeletePolicy", "iam:DeletePolicyVersion", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DeleteUser", "iam:DeleteUserPolicy", "iam:Detach*", "iam:PassRole", "iam:PutRolePermissionsBoundary", "iam:PutRolePolicy", "iam:PutUserPolicy", "iam:RemoveRoleFromInstanceProfile", "iam:RemoveUserFromGroup", "iam:Tag*", "iam:Untag*", "iam:Get*", "iam:List*", "iam:UpdateAssumeRolePolicy", "iam:UpdateGroup", "iam:UpdateRole", "iam:UpdateRoleDescription", ] resources = [ "*", ] } } data "aws_iam_policy_document" "atlantis_apply_policy_part_two" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { actions = [ "inspector2:BatchGetAccountStatus", "inspector2:Disable", "inspector2:Enable", "inspector2:ListAccountPermissions", "kafka:*", "kafkaconnect:*", "kinesis:AddTagsToStream", "kinesis:CreateStream", "kinesis:DecreaseStreamRetentionPeriod", "kinesis:DeleteStream", "kinesis:DeregisterStreamConsumer", "kinesis:Describe*", "kinesis:DisableEnhancedMonitoring", "kinesis:EnableEnhancedMonitoring", "kinesis:Get*", "kinesis:IncreaseStreamRetentionPeriod", "kinesis:List*", "kinesis:RegisterStreamConsumer", "kinesis:RemoveTagsFromStream", "kinesis:StartStreamEncryption", "kinesis:UpdateShardCount", "kms:CreateAlias", "kms:CreateGrant", "kms:CreateKey", "kms:Get*", "kms:GenerateDataKey*", "kms:DeleteAlias", "kms:Describe*", "kms:EnableKeyRotation", "kms:Encrypt", "kms:PutKeyPolicy", "kms:RetireGrant", "kms:ReEncrypt*", "kms:TagResource", "kms:UntagResource", "kms:List*", "kms:UpdateKeyDescription", "lakeformation:GrantPermissions", "lakeformation:List*", "lakeformation:RevokePermissions", "lambda:Add*", "lambda:Create*", "lambda:Delete*", "lambda:Get*", "lambda:List*", "lambda:PublishVersion", "lambda:Put*", "lambda:RemovePermission", "lambda:TagResource", "lambda:UntagResource", "lambda:Update*", "logs:*", "ram:*ResourceShare", "ram:Get*", "ram:List*", "ram:TagResource", "ram:UntagResource", "rds:Add*", "rds:CreateDB*", "rds:CreateEventSubscription", "rds:DeleteDB*", "rds:DeleteEventSubscription", "rds:DeregisterDBProxyTargets", "rds:ModifyDB*", "rds:RegisterDBProxyTargets", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:ResetDBClusterParameterGroup", "rds:RestoreDBClusterFromSnapshot", "rds:Describe*", "rds:List*", "resource-explorer-2:*", "route53:AssociateVPCWithHostedZone", "route53:ChangeResourceRecordSets", "route53:ChangeTagsForResource", "route53:CreateHostedZone", "route53:CreateHealthCheck", "route53:CreateQueryLoggingConfig", "route53:CreateVPCAssociationAuthorization", "route53:Get*", "route53:List*", "route53:UpdateHostedZoneComment", "route53:UpdateHealthCheck", "route53profiles:*", "s3:*", "sagemaker:*", "secretsmanager:*ResourcePolicy", "secretsmanager:CancelRotateSecret", "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:Describe*", "secretsmanager:Get*", "secretsmanager:List*", "secretsmanager:PutSecretValue", "secretsmanager:TagResource", "secretsmanager:UntagResource", "secretsmanager:UpdateSecret", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:RotateSecret", "ses:CreateReceiptRule*", "ses:DeleteReceiptRule*", "ses:Get*", "ses:DeleteIdentityPolicy", "ses:Describe*", "ses:List*", "ses:PutIdentityPolicy", "ses:ReorderReceiptRuleSet", "ses:SetReceiptRulePosition", "ses:SetActiveReceiptRuleSet", "ses:VerifyDomain*", "ses:VerifyEmailIdentity", "ses:UpdateReceiptRule", "sns:*", "scheduler:*", "sqs:*", "ssm:*", "storagegateway:*", "states:*", "swf:DeprecateDomain", "swf:Describe*", "swf:Get*", "swf:List*", "swf:RegisterDomain", "swf:TagResource", "swf:UntagResource", "transfer:Create*", "transfer:Describe*", "transfer:List*", "transfer:TagResource", "transfer:UntagResource", "transfer:Update*", "waf:Get*", "waf:List*", "wafv2:AssociateWebACL", "wafv2:CreateIPSet", "wafv2:CreateRuleGroup", "wafv2:CreateWebACL", "wafv2:DeleteIPSet", "wafv2:DeleteLoggingConfiguration", "wafv2:DeleteRuleGroup", "wafv2:DeleteWebACL", "wafv2:Get*", "wafv2:List*", "wafv2:PutLoggingConfiguration", "wafv2:TagResource", "wafv2:UpdateIPSet", "wafv2:UpdateRuleGroup", "wafv2:UpdateWebACL", ] resources = [ "*", ] } statement { actions = [ "rds-db:connect" ] resources = [ "arn:aws:rds-db:*:${data.aws_caller_identity.current.account_id}:dbuser:*/atlantis" ] } } data "aws_iam_policy_document" "atlantis_kms_delete_policy" { statement { actions = [ "kms:DeleteAlias", ] resources = [ "arn:aws:kms:*:${data.aws_caller_identity.current.account_id}:alias/lambda-*", "arn:aws:kms:*:${data.aws_caller_identity.current.account_id}:key/*", ] } statement { actions = [ "kms:ScheduleKeyDeletion", "kms:DisableKey", ] resources = ["*"] condition { test = "StringLike" variable = "kms:ResourceTag/service_name" values = ["lambda-*"] } } } data "aws_iam_policy_document" "atlantis_kms_reencrypt_policy" { statement { effect = "Allow" actions = [ "kms:ReEncryptFrom" ] resources = [ "arn:aws:kms:*:086679231553:alias/shared-base-ami-key", ] } } data "aws_iam_policy_document" "atlantis_invoke_lambdas_policy" { statement { effect = "Allow" actions = [ "lambda:InvokeFunction", ] resources = concat( local.lambda_function_arns_to_invoke, [ "arn:aws:lambda:*:${data.aws_caller_identity.current.account_id}:function:${var.environment}-lambda-auth0-m2m-token-secret-rotation", "arn:aws:lambda:*:${data.aws_caller_identity.current.account_id}:function:${var.environment}-lambda-auth0-m2m-token-secret-rotation:*" ], ) } }