Specifying the Roles an IAM Identity Can Assume

ACM.33 Limiting the Confused Deputy Attack in IAM Policies

⚙️ Check out my series on [*Automating Cybersecurity Metrics](https://medium.com/cloud-security/automating-cybersecurity-metrics-890dfabb6198). The [Code](https://github.com/tradichel).*

🔒 Related Stories: [*IAM](https://medium.com/cloud-security/aws-iam-932d6a043b7) | [AWS Security](https://medium.com/cloud-security/aws-security-8a038e16e1f1) | [Application Security](https://medium.com/cloud-security/application-security-77580cf52d1d)*

💻 Free Content on* [Jobs in Cybersecurity](https://medium.com/cloud-security/cybersecurity-careers-and-jobs-69c05616d2b4) | *✉️ Sign up for the [*Email List](https://2ndsightlab.medium.com/subscribe)*

In the last post we used AWS CloudFormation conditions and mappings to overcome a security problem with trust policies — the confused deputy attack.

[embed]Conditions and Mappings in CloudFormation Templates ACM.32 Preventing the Confused Deputy Attack in Batch Job Rolesmedium.com

In the post on the confused deputy problem I referred to the IAM documentation that explains how to limit the ability for a user to assume a role with a IAM Policy like this:

[embed]Confused Deputy Attack in IAM, Resource, and AssumeRole Policies ACM.31: Considering how an attacker could abuse role templatesmedium.com

Recall that an IAM Policy places restrictions on an identity as opposed to a resource or role assumption as I explained here:

[embed]Resource, IAM, and Trust Policies on AWS ACM.24 Architecting defense in depth AWS policies.medium.com

Let’s review the policy for our IAM Admin user that we created earlier. Navigate to the IAM console and search for your IAM Admin are review permissions. Notice that we have allowed the IAM user to assume a role that starts with the name BatchRole.

Question:

This is implemented without a condition like the example above. This policy instead whitelists the role resources the user can assume. Does it work?

Run the script in the root directory one more time.

When the script asks me for a code to assume the role it does fail with an unauthorized message:

Why didn’t we get the unauthorized message when we tested the first time? Maybe I missed it. It also could be that the trust policy had not completely updated by the time the batch job test ran. As I mentioned, IAM is eventually consistent, meaning it doesn’t lock out users while making changes. AWS will enforce the new policy as the change gets pushed out to all systems.

Let’s update our IAM policy to use the new prefix for IAM roles.

Our IAM administrator policy exists at:

iam/iam_admins/cfn/policy.yaml

Change this:

To this:

Deploy the change by executing the deploy script found here:

iam/iam_admins/deploy.sh

like this:

./deploy.sh

*Notice how easy it was to deploy one change compared to a huge monolithic CloudFormation template. You may have seen such templates elsewhere. Don’t do it. Think ahead and build your CloudFormation templates so you can change and test individual resources easily.*

Now if you were to try to test the script again you would still get an error.

./test.sh

That’s because the role BatchRoleDeployBatchJobCredentials no longer exists and that’s what we have configured the AWS CLI to use as explained in these two posts:

[embed]Using an AWS CLI Profile with MFA ACM.28 Testing our KMS Administrator Permissions with the AWS CLImedium.com

[embed]Modifying A Role CloudFormation Template to Pass in an ARN to Assume the Role ACM.30 Allowing an IAM admin to run IAM-related batch jobsmedium.com

Head over to IAM and search for the role:

Now just search for Deploy:

Our role has been renamed to start with IAM as expected. Edit your AWS config file as explained in the posts above to use this role instead of the old batch job role.

Now I can assume the role.

This proves that our version of an IAM Policy works just as good as a policy with a condition. In fact, I think it’s a bit cleaner. Defining specific ARNs likely has stricter type checking than the logic used behind the scenes to parse conditions. If you’re wondering why that is, it’s explained in this series on secure code:

[embed]Secure Code By Design Programming tactics that prevent vulnerabilities and defend applications against cyber attacksmedium.com

Next we’ll look at resource policies and the confused deputy attack.

Follow for updates.

Teri Radichel | © 2nd Sight Lab 2022

About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab

Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation

Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab