AWS Altering ARNs in Belief Insurance policies — Huge Issues | by Teri Radichel | Cloud Safety | Oct, 2022 | Boot Tech

ACM.94 Trying to revive issues after a person has been deleted leaves the person in a nasty state for which there is no such thing as a easy restoration

This can be a continuation of my collection on automating cybersecurity metrics.

Whereas updating my code in earlier posts, the KMSAdmin person was inadvertently eliminated, so I used to be unable to handle the KMS keys by assuming the related KMS position. The person was faraway from the KMS directors group. The developer person was additionally faraway from the AppDeployment group, which hampered deployments for that position.

I’ve tried re-running the CloudFormation templates that add customers to teams. Because the template hadn’t modified, operating it once more has no impact. CloudFormation solely deploys templates which have modified, not issues which are out of sync with what needs to be deployed.

When you’ve been following, you realize I added an output to drive replace each time a KMS secret is deployed to resolve this subject when AWS magically alters the ARNs in key insurance policies. I attempted that strategy once more for this drawback.

Since I would like a timestamp twice now, I created a shared perform for it (the abstraction precept I have been telling you about repeatedly, do not repeat your self or the DRY precept):

I added the timestamp to my add_user_to_group perform:

Sadly, that did not work for this state of affairs. I maintain getting an error that the KMS administrator can not assume the group position.

Go to the belief coverage. AHA. AWS does the identical factor for belief insurance policies because it does for KMS key insurance policies and would not replace for a similar causes. Apparently the deleted person’s ARN was changed with some sort of logical ID and the coverage is now not appropriate, nor does something associated to it work.

Cross the position so as to add the timestamp to drive an replace identical as above. Good factor I made get_timestamp a typical perform. 🙂

OK, issues are getting bizarre. My position is certainly to redeploy with the pressured replace. I can see the brand new parameter and the output within the template in CloudFormation. I can see that the right KMS admin person was handed as a parameter. The stack is proven updated. There are not any errors within the deployment script.

And but… the belief coverage has not been up to date. This can be a drawback.

If I attempt to take away the position in CloudFormation it’s going to fail as a result of all the important thing insurance policies reference it. And plenty of issues confer with all of the keys.

UGGGHHH.

So now I might manually replace the belief coverage, however that may be dangerous. And it is at this level that I notice that is going to be a single weblog submit as a result of that is very, very problematic.

I actually don’t assume Amazon needs to be altering buyer insurance policies. 

So what can we do about it? I can attempt to drive the belief coverage in another approach because the drive replace parameter would not work. I can briefly add one other person to the belief coverage after which take away it once more, possibly.

What occurs if I alter the identify of the group?

Effectively, possibly the group simply would not replace the belief coverage…

What occurs if I alter enable to disclaim?

Thankfully, my IAM position is in a separate deployment script; in any other case it might block my IAM admin if I had eliminated that person and group addition as effectively. You may additionally extract the KMS supervisor right into a separate script, as I do not need this variation to use to all different belief insurance policies when making an attempt to drive this replace. That appears safer. Let’s do this.

check.sh:

Effectively, one thing occurred however not what we wished. The replace failed. Here’s a bug:

That is why:

Let’s change it again to Enable and attempt to determine one thing else out.

And now now we have an enormous mess:

That is the sort of nightmare you may get into with CloudFormation and the truth that AWS is altering these insurance policies with out the shopper figuring out is an enormous deal in my view. This does not appear to be the right resolution for no matter drawback it was supposed to unravel. Please cease doing this. #awswishlist

Let's take into consideration this for a minute. If a person is deleted and a coverage references an ARN for a useful resource that doesn't exist, what's the danger? Nothing can use that coverage as a result of no associated person exists to make use of the permission. There isn't any must delete the person on this coverage in that case.However ...if somebody does re-add the person again in with the identical ARN, that person can now use the permissions within the coverage. However is it actually the identical person? Somebody might delete a person and add again in a single they've credentials for to realize entry to some permissions they should not have. That's the danger AWS is making an attempt to guard you in opposition to.Nonetheless, I'd argue that it might be higher to warn the person earlier than making the change and disallow the change, or optionally enable the person so as to add a deny assertion for that ARN to the coverage relatively than simply change the coverage and mangle a buyer's complete stack of assets within the course of. I am positive somebody at AWS can consider a greater resolution primarily based on how issues work behind the scenes than what is going on above.

Fortunately I am solely in a POC atmosphere and I can actually delete all the pieces and begin over. I ought to in all probability write a script for that…

Subsequent submit.

Teri Radichel

When you like this story please applaud Y proceed:

Medium: Teri Radichel or E mail Record: Teri Radichel
Twitter: @teriradichel or @2ndSightLab
Requests companies by way of LinkedIn: Teri Radichel or IANS Analysis

© second sight lab 2022

All posts on this collection:

_____________________________________________

Writer:

Cybersecurity for executives within the cloud period at Amazon

Do you want cloud safety coaching? 2nd Sight Lab Cloud Safety Coaching

Is your cloud safe? Rent 2nd Sight Lab for a penetration check or safety evaluation.

Do you’ve a query about cybersecurity or cloud safety? Ask Teri Radichel by scheduling a name with IANS Analysis.

Cybersecurity and Cloud Safety Sources by Teri Radichel: Cybersecurity and cloud safety courses, articles, white papers, shows, and podcasts