sec(iac): enforce non-empty ExternalId on cross-account AssumeRole at IAM layer#571
sec(iac): enforce non-empty ExternalId on cross-account AssumeRole at IAM layer#571cristim wants to merge 1 commit into
Conversation
…lls (closes #436) Add a StringLike "*" condition on sts:ExternalId to the cross_account_sts IAM policy in both the Lambda and Fargate compute modules. This requires every sts:AssumeRole call from these compute roles to supply a non-empty ExternalId value; AWS will deny the call at the IAM layer if it is absent. Per-account ExternalId validation (matching the registered value in the DB) still happens at the application layer in the credentials resolver. The IAM condition is a second layer of defence: even if a bug in the resolver omitted the ExternalId entirely, IAM would block the call before it reached the target account. This closes the gap noted in #436 where the CloudFormation target-account trust policy enforced ExternalId but the Lambda/Fargate calling policy did not.
cristim
added
bug
|
Warning Review limit reached
Your plan currently allows 2 reviews/hour. Refill in 24 minutes and 21 seconds. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more review capacity refills, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
1 participant
Summary
Condition: { StringLike: { "sts:ExternalId": "*" } }to thecross_account_stsIAM policy in bothterraform/modules/compute/aws/lambda/main.tfandterraform/modules/compute/aws/fargate/main.tfsts:ExternalIdon everyAssumeRolecall from these compute roles; calls without the field are denied at the IAM layer before reaching the target accountterraform fmt -checkpasses with no changes on both modulesCloses #436