rules:
- id: no-iam-priv-esc-funcs
  patterns:
  - pattern-either:
    - patterns:
      - pattern-inside: |
          resource $TYPE "..." {
            ...
            policy = jsonencode({
              ...
              Statement = [
                ...
              ]
              ...
            })
            ...
          }
      - pattern-not-inside: |
          resource $TYPE "..." {
            ...
            policy = jsonencode({
              ...
              Statement = [
                ...,
                {... Effect = "Deny" ...},
                ...
              ]
              ...
            })
            ...
          }
      - pattern: Action = $ACTION
      - metavariable-pattern:
          metavariable: $TYPE
          pattern-either:
          - pattern: |
              "aws_iam_role_policy"
          - pattern: |
              "aws_iam_policy"
          - pattern: |
              "aws_iam_user_policy"
          - pattern: |
              "aws_iam_group_policy"
    - patterns:
      - pattern-inside: |
          data aws_iam_policy_document "..." {
            ...
            statement {
              ...
            }
            ...
          }
      - pattern-not-inside: |
          data aws_iam_policy_document "..." {
            ...
            statement {
              ...
              effect = "Deny"
              ...
            }
            ...
          }
      - pattern: |
          actions = [..., $ACTION, ...]
  - metavariable-pattern:
      metavariable: $ACTION
      pattern-either:
      - pattern: |
          "iam:AddUserToGroup"
      - pattern: |
          "iam:CreatePolicyVersion"
      - pattern: |
          "iam:SetDefaultPolicyVersion"
      - pattern: |
          "iam:AttachUserPolicy"
      - pattern: |
          "iam:AttachGroupPolicy"
      - pattern: |
          "iam:AttachRolePolicy"
      - pattern: |
          "iam:PutUserPolicy"
      - pattern: |
          "iam:PutGroupPolicy"
      - pattern: |
          "iam:PutRolePolicy"
      - pattern: |
          "glue:UpdateDevEndpoint"
      - pattern: |
          "iam:*"
      - pattern: |
          "glue:*"
  message: >-
    Ensure that actions that can result in privilege escalation are not used.
    These actions could potentially result in an attacker gaining full administrator access of an AWS
    account.
    Try not to use these actions.
  metadata:
    references:
    - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
    - https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/
    category: security
    cwe:
    - 'CWE-250: Execution with Unnecessary Privileges'
    technology:
    - terraform
    - aws
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
  languages: [hcl]
  severity: WARNING