rules:
- id: no-iam-priv-esc-other-users
  patterns:
  - pattern-either:
    - patterns:
      - pattern-inside: |
          resource $TYPE "..." {
            ...
            policy = jsonencode({
              ...
              Statement = [
                ...,
                {... Resource = $RESOURCE ...},
                ...
              ]
              ...
            })
            ...
          }
      - pattern-not-inside: |
          resource $TYPE "..." {
            ...
            policy = jsonencode({
              ...
              Statement = [
                ...,
                {... Effect = "Deny" ...},
                ...
              ]
              ...
            })
            ...
          }
      - pattern: |
          Action = $ACTION
      - metavariable-pattern:
          metavariable: $TYPE
          pattern-either:
          - pattern: |
              "aws_iam_role_policy"
          - pattern: |
              "aws_iam_policy"
          - pattern: |
              "aws_iam_user_policy"
          - pattern: |
              "aws_iam_group_policy"
    - patterns:
      - pattern-inside: |
          data aws_iam_policy_document "..." {
            ...
            statement {
              ...
              resources = $RESOURCE
              ...
            }
            ...
          }
      - pattern-not-inside: |
          data aws_iam_policy_document "..." {
            ...
            statement {
              ...
              effect = "Deny"
              ...
            }
            ...
          }
      - pattern: |
          actions = [..., $ACTION, ...]
  - metavariable-pattern:
      metavariable: $RESOURCE
      pattern-either:
      - pattern-regex: .*\*.*
  - metavariable-pattern:
      metavariable: $ACTION
      pattern-either:
      - pattern: |
          "iam:CreateAccessKey"
      - pattern: |
          "iam:CreateLoginProfile"
      - pattern: |
          "iam:UpdateLoginProfile"
      - pattern: |
          "iam:*"
  message: >-
    Ensure that IAM policies with permissions on other users don't allow for privilege escalation. This
    can lead to an attacker gaining full administrator access of AWS accounts. Instead, specify which
    user the permission should be used on or do not use the listed actions. $RESOURCE
  metadata:
    references:
    - https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/
    - https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPrivilegeEscalation.py
    category: security
    cwe:
    - 'CWE-269: Improper Privilege Management'
    technology:
    - terraform
    - aws
    owasp:
    - A04:2021 - Insecure Design
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
  languages: [hcl]
  severity: WARNING