Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Permission boundaries not considered when querying #129

Open
nimaft opened this issue Dec 19, 2022 · 0 comments
Open

Permission boundaries not considered when querying #129

nimaft opened this issue Dec 19, 2022 · 0 comments
Assignees
Labels
question Further information is requested

Comments

@nimaft
Copy link

nimaft commented Dec 19, 2022

Question

I have a role with administrative privileges (let's call it privileged-role) and it has a permission boundary attached to it denying iam actions. However when I run the following query:
pmapper --account ACC# query -s 'who can do iam:*'
I get results like this:

role/rdkLambdaRole-KOQRA8051N84 CAN call action iam:* for resource * THRU role/privileged-role
   role/rdkLambdaRole-KOQRA8051N84 can access via sts:AssumeRole role/cdk-hnb659fds-deploy-role 
   role/cdk-hnb659fds-deploy-role can create a stack in CloudFormation to access role/privileged-role
   role/privileged-role IS authorized to call action iam:* for resource *

I also tried using conditions to take permission boundaries into account, but the results are the same. Sample query:
pmapper --account ACC# query -s 'who can do iam:* with * when iam:PermissionsBoundary=arn:aws:iam::ACC#:policy/perm_boundary'

Did the Wiki Have an Answer?

I did not find any answers in Wiki. Not a lot of information can be found on using conditions with queries. I'd add the answer in "Query Reference".

@nimaft nimaft added the question Further information is requested label Dec 19, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
question Further information is requested
Projects
None yet
Development

No branches or pull requests

2 participants