Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
AWS Access Permissions and Trusts - AskJ1 Community
<main> <article class="userContent"> <blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line">Tip: If you have over 10,000 AWS resources in multiple AWS accounts, some query execution may take a long time or occasionally time out. Try limiting the query by adding <code class="code codeInline" spellcheck="false" tabindex="0">and tag.AccountName='account-name'</code> as part of the <code class="code codeInline" spellcheck="false" tabindex="0">WITH</code> entity property filter. Or use <code class="code codeInline" spellcheck="false" tabindex="0">LIMIT 100</code> at the end of the query for a smaller sample set of the results.</p> </div></blockquote> <h2 data-id="iam-policy-permissions">IAM Policy Permissions</h2> <h3 data-id="which-policies-allow-access-to-production-data">Which policies allow access to production data?</h3> <pre class="code codeBlock" spellcheck="false" tabindex="0">find AccessPolicy as policy that allows as permission (aws_s3|aws_dynamodb|aws_rds|DataStore) with tag.Production=true as resource return policy._type, policy.name, resource._type, resource.name, resource.tag.AccountName, permission.actions, permission.resources </pre> <h3 data-id="who-has-admin-access-to-production-resources">Who has admin access to production resources?</h3> <pre class="code codeBlock" spellcheck="false" tabindex="0">find (aws_iam_group|aws_iam_user|aws_iam_role) as principal that assigned AccessPolicy as policy that allows as permission * with tag.Production=true as resource where permission.admin=true return principal._type, principal.name, principal.tag.AccountName, policy._type, policy.name, permission.actions, permission.resources, resource._type, resource.name, resource.tag.AccountName </pre> <h2 data-id="iam-assume-role-trusts">IAM Assume Role Trusts</h2> <h3 data-id="what-are-the-cross-account-trusts">What are the cross-account trusts?</h3> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find aws_iam_role as a that trusts (aws_account|aws_iam_role) as b where a.tag.AccountName!=b.tag.AccountName return tree </pre> <h3 data-id="are-there-assume-role-trusts-to-external-entities">Are there assume role trusts to external entities?</h3> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find aws_account as aws that HAS aws_iam that HAS aws_iam_role as role that TRUSTS (aws_iam_role|aws_iam_user|aws_iam_group|aws_account) with _source='system-mapper' as ext return aws.name, aws.accountId, role.roleName, ext.displayName, ext._type </pre> <h3 data-id="iam-roles-and-policies-assigned-to-okta-sso-users">IAM Roles and Policies assigned to Okta SSO Users</h3> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find okta_user as user that assigned aws_iam_role as role that assigned aws_iam_policy as policy return role.name, policy.name, count(user) as userCount order by userCount desc </pre> <h3 data-id="what-iam-roles-can-active-public-facing-ec2-instances-assume">What IAM roles can active public facing EC2 instances assume?</h3> <pre class="code codeBlock" spellcheck="false" tabindex="0">find Internet that allows aws_security_group that protects aws_instance with active=true that uses aws_iam_role that assigned AccessPolicy return tree </pre> <p><em>OR</em></p> <pre class="code codeBlock" spellcheck="false" tabindex="0">find (Network|Host) with _source='system-mapper' that allows aws_security_group that protects aws_instance with active=true that uses aws_iam_role that assigned AccessPolicy return tree </pre> <blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line">Tip: from the above, the <code class="code codeInline" spellcheck="false" tabindex="0">(Network|Host) with _source='system-mapper'</code> portion of the query looks for <code class="code codeInline" spellcheck="false" tabindex="0">Network</code> or <code class="code codeInline" spellcheck="false" tabindex="0">Host</code> entities created by the <code class="code codeInline" spellcheck="false" tabindex="0">system-mapper</code> —- meaning those are networks and hosts <strong>“external”</strong> to your environment, not ingested by the integration.</p> </div></blockquote> <h2 data-id="s3-bucket-permissions">S3 Bucket permissions</h2> <h3 data-id="are-there-non-public-s3-buckets-configured-with-public-access-to-everyone">Are there non-public S3 buckets configured with public access to everyone?</h3> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find aws_s3_bucket with classification!='public' or classification=undefined that ALLOWS everyone </pre> <h3 data-id="what-are-the-cross-account-access-to-non-public-s3-buckets">What are the cross account access to non-public S3 buckets?</h3> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find aws_s3_bucket with classification != 'public' as a that allows * as b where a.tag.AccountName != b.tag.AccountName return tree </pre> <h3 data-id="who-can-read-non-public-s3-buckets-in-production">Who can read non-public S3 buckets in production?</h3> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find (User|UserGroup|AccessRole) that assigned AccessPolicy that allows as permission (aws_s3|aws_s3_bucket) with classification!='public' and tag.Production=true where permission.read=true return tree </pre> <h3 data-id="which-ec2-instances-can-read-data-from-s3-via-an-iam-role">Which EC2 instances can read data from S3 via an IAM role?</h3> <pre class="code codeBlock" spellcheck="false" tabindex="0">find aws_instance that uses aws_iam_role that assigned AccessPolicy that allows as permission (aws_s3|aws_s3_bucket) where permission.read=true return tree </pre> <h2 data-id="other">Other</h2> <h3 data-id="what-are-the-inline-policies-in-use">What are the Inline Policies in use?</h3> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find (aws_iam_user|aws_iam_group|aws_iam_role) as u that (has|assigned) (aws_iam_user_policy|aws_iam_group_policy|aws_iam_role_policy) as p return u.tag.AccountName, u._type, u.name, p.name order by u.tag.AccountName </pre> </article> </main>
.png)