#!/bin/bash # # Evaluates specified AWS IAM Role or Policy given their name/Arn. # Dumps all of the attached policies in case of Role and all of defined # policy statements. Then goes through allowed permissions to pick all of them out. # Finally, checks every allowed permission against a list of known troublesome ones. # # Mariusz B., mgeeky '19, <mb@binary-offensive.com> # v0.1 # if [ $# -lt 2 ] ; then echo "Usage: evaluate-iam-role.sh [-v] <profile> <role-name|policy-arn>" echo echo -e "-v\t\t\tVerbose mode. Dumps full roles/policies contents." echo -e "profile\t\t\tAWS credentials profile name." echo -e "role-name|policy-name\tEither IAM Role name or Policy Arn to evaluate." echo -e "\t\t\tIf 'all' was specified, will evaluate ALL used IAM Roles" exit 1 fi VERBOSE=0 if [[ "$1" == "-v" ]]; then VERBOSE=1 shift fi PROFILE=$1 ROLE_NAME=$2 known_potentially_dangerous_permissions=( ".+:\*" ".*:Add.*" ".*:Attach.*" ".*:Batch.*" ".*:Change.*" ".*:Command.*" ".*:Create.*" ".*:Delete.*" ".*:Execute.*" ".*:Invoke.*" ".*:Modify.*" ".*:Put.*" ".*:Reboot.*" ".*:Register.*" ".*:Replace.*" ".*:Run.*" ".*:Send.*" ".*:Set.*" ".*:Start.*" ".*:Update.*" ) known_dangerous_permissions=( "\*:\*" "cloudformation:CreateStack" "datapipeline:CreatePipeline" "datapipeline:PutPipelineDefinition" "ec2:RunInstances" "glue:CreateDevEndpoint" "glue:UpdateDevEndpoint" "iam:\*" "iam:AddUserToGroup" "iam:AttachGroupPolicy" "iam:AttachRolePolicy" "iam:AttachUserPolicy" "iam:CreateAccessKey" "iam:CreateLoginProfile" "iam:CreatePolicyVersion" "iam:PassRole" "iam:PassRole" "iam:PutGroupPolicy" "iam:PutRolePolicy" "iam:PutUserPolicy" "iam:SetDefaultPolicyVersion" "iam:UpdateAssumeRolePolicy" "iam:UpdateLoginProfile" "lambda:CreateEventSourceMapping" "lambda:CreateFunction" "lambda:InvokeFunction" "lambda:UpdateFunctionCode" "sts:AssumeRole" ) known_dangerous_aws_managed_policies=( "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM" "arn:aws:iam::aws:policy/service-role/AmazonMachineLearningRoleforRedshiftDataSource" ) dangerous_permissions=() potentially_dangerous_permissions=() all_perms=() used_bad_policies=() function examine_policy() { policy=$1 role_name=$2 out=$(aws --profile $PROFILE iam get-policy --policy-arn $policy) version_id=$(echo "$out" | jq -r '.Policy.DefaultVersionId') policy_name=$(echo "$out" | jq -r '.Policy.PolicyName') policy_version=$(aws --profile $PROFILE iam get-policy-version --policy-arn $policy --version-id $version_id) if [[ $VERBOSE == 1 ]]; then echo -e "\n------------[ Policy Arn: $policy ]------------" echo "$policy_version" fi permissions=($(echo "$policy_version" | jq -r '.PolicyVersion.Document.Statement[] | select(.Effect=="Allow") | if .Action|type=="string" then [.Action] else .Action end | .[]')) path="" if [[ "$role_name" != "" ]]; then path="$role_name.$policy_name." else path="$policy_name." fi if [[ "$ROLE_NAME" != "all" ]] ; then path="" fi for bad_policy in "${known_dangerous_aws_managed_policies[@]}"; do if echo "$policy" | grep -iq "$bad_policy" ; then used_bad_policies+=("$path$bad_policy") fi done for perm in "${permissions[@]}" ; do permadd="$path$perm" all_perms+=("$permadd") for potdangperm in "${known_potentially_dangerous_permissions[@]}"; do if [[ "$perm" == "iam:*" ]]; then continue ; fi if echo "$perm" | grep -Piq "$potdangperm" ; then potentially_dangerous_permissions+=("$permadd") fi done for dangperm in "${known_dangerous_permissions[@]}"; do if echo "$perm" | grep -iq "$dangperm" ; then dangerous_permissions+=("$permadd") fi done done } function examine_role() { role_name=$1 role_policy=$(aws --profile $PROFILE iam get-role --role-name $role_name) if [[ $VERBOSE == 1 ]]; then echo -e "------------[ Role: $role_name ]------------" echo "$role_policy" fi attached_role_policies=($(aws --profile $PROFILE iam list-attached-role-policies --role-name $role_name | jq -r '.AttachedPolicies[].PolicyArn')) if [[ $VERBOSE == 1 ]]; then echo fi echo "[+] Role ($role_name) has following policies attached:" for policy in "${attached_role_policies[@]}" ; do echo -e "\t- $policy" done if [[ $VERBOSE == 1 ]]; then echo fi for policy in "${attached_role_policies[@]}" ; do examine_policy $policy $role_name done } # #------------------------------------------------------------------ # IFS=$'\n' if [[ "$ROLE_NAME" == "all" ]]; then echo "[+] Evaluating ALL used IAM Roles" echo out=($(aws --profile $PROFILE iam list-roles --query 'Roles[*].RoleName' --output text | tr '\t' '\n')) for role in "${out[@]}"; do examine_role $role done elif echo "$ROLE_NAME" | grep -q "arn:aws:iam:" && echo "$ROLE_NAME" | grep -q ":policy/" ; then echo "[+] Working on specified Policy Arn: $ROLE_NAME" echo examine_policy $ROLE_NAME else echo "[+] Working on specified Role: $ROLE_NAME" echo examine_role $ROLE_NAME fi #------------------------------------------------------------------ if [[ ${#used_bad_policies[@]} -gt 0 ]]; then echo -e "\n\n[-] =============== Found AWS Managed Insecure Policies in Use ===============" echo sorted=($(echo "${used_bad_policies[@]}" | tr ' ' '\n' | sort -u )) for pol in "${sorted[@]}"; do echo -e "\t$pol" done fi if [[ ${#all_perms[@]} -gt 0 ]]; then echo -e "\n\n[+] =============== Permissions granted ===============" echo sorted=($(echo "${all_perms[@]}" | tr ' ' '\n' | sort -u )) for perm in "${sorted[@]}"; do echo -e "\t$perm" | sed -r 's/\./ -> /g' done if [[ ${#potentially_dangerous_permissions[@]} -gt 0 ]]; then echo -e "\n\n[-] =============== Detected POTENTIALLY dangerous permissions granted ===============" echo sorted=($(echo "${potentially_dangerous_permissions[@]}" | tr ' ' '\n' | sort -u )) for dangperm in "${sorted[@]}"; do echo -e "\t$dangperm" | sed -r 's/\./ -> /g' done fi if [[ ${#dangerous_permissions[@]} -gt 0 ]]; then echo -e "\n\n[!] =============== Detected DANGEROUS permissions granted ===============" echo sorted=($(echo "${dangerous_permissions[@]}" | tr ' ' '\n' | sort -u )) for dangperm in "${sorted[@]}"; do echo -e "\t$dangperm" | sed -r 's/\./ -> /g' done fi else echo -e "\nNo permissions were found to be granted." fi echo