mcp-server-semgrep
Version:
MCP Server for Semgrep Integration - static code analysis with AI
793 lines (792 loc) • 22.3 kB
YAML
rules:
- id: no-iam-resource-exposure
patterns:
- pattern-either:
- patterns:
- pattern-inside: |
resource $TYPE "..." {
...
policy = jsonencode({
...
Statement = [
...
]
...
})
...
}
- pattern-not-inside: |
resource $TYPE "..." {
...
policy = jsonencode({
...
Statement = [
...,
{... Effect = "Deny" ...},
...
]
...
})
...
}
- pattern: |
Action = $ACTION
- metavariable-pattern:
metavariable: $TYPE
pattern-either:
- pattern: |
"aws_iam_role_policy"
- pattern: |
"aws_iam_policy"
- pattern: |
"aws_iam_user_policy"
- pattern: |
"aws_iam_group_policy"
- patterns:
- pattern-inside: |
data aws_iam_policy_document "..." {
...
statement {
...
}
...
}
- pattern-not-inside: |
data aws_iam_policy_document "..." {
...
statement {
...
effect = "Deny"
...
}
...
}
- pattern: |
actions = [..., $ACTION, ...]
- metavariable-pattern:
metavariable: $ACTION
pattern-either:
- pattern: |
"acm-pca:CreatePermission"
- pattern: |
"acm-pca:DeletePermission"
- pattern: |
"acm-pca:DeletePolicy"
- pattern: |
"acm-pca:PutPolicy"
- pattern: |
"apigateway:UpdateRestApiPolicy"
- pattern: |
"backup:DeleteBackupVaultAccessPolicy"
- pattern: |
"backup:PutBackupVaultAccessPolicy"
- pattern: |
"chime:DeleteVoiceConnectorTerminationCredentials"
- pattern: |
"chime:PutVoiceConnectorTerminationCredentials"
- pattern: |
"cloudformation:SetStackPolicy"
- pattern: |
"cloudsearch:UpdateServiceAccessPolicies"
- pattern: |
"codeartifact:DeleteDomainPermissionsPolicy"
- pattern: |
"codeartifact:DeleteRepositoryPermissionsPolicy"
- pattern: |
"codebuild:DeleteResourcePolicy"
- pattern: |
"codebuild:DeleteSourceCredentials"
- pattern: |
"codebuild:ImportSourceCredentials"
- pattern: |
"codebuild:PutResourcePolicy"
- pattern: |
"codeguru-profiler:PutPermission"
- pattern: |
"codeguru-profiler:RemovePermission"
- pattern: |
"codestar:AssociateTeamMember"
- pattern: |
"codestar:CreateProject"
- pattern: |
"codestar:DeleteProject"
- pattern: |
"codestar:DisassociateTeamMember"
- pattern: |
"codestar:UpdateTeamMember"
- pattern: |
"cognito-identity:CreateIdentityPool"
- pattern: |
"cognito-identity:DeleteIdentities"
- pattern: |
"cognito-identity:DeleteIdentityPool"
- pattern: |
"cognito-identity:GetId"
- pattern: |
"cognito-identity:MergeDeveloperIdentities"
- pattern: |
"cognito-identity:SetIdentityPoolRoles"
- pattern: |
"cognito-identity:UnlinkDeveloperIdentity"
- pattern: |
"cognito-identity:UnlinkIdentity"
- pattern: |
"cognito-identity:UpdateIdentityPool"
- pattern: |
"deeplens:AssociateServiceRoleToAccount"
- pattern: |
"ds:CreateConditionalForwarder"
- pattern: |
"ds:CreateDirectory"
- pattern: |
"ds:CreateMicrosoftAD"
- pattern: |
"ds:CreateTrust"
- pattern: |
"ds:ShareDirectory"
- pattern: |
"ec2:CreateNetworkInterfacePermission"
- pattern: |
"ec2:DeleteNetworkInterfacePermission"
- pattern: |
"ec2:ModifySnapshotAttribute"
- pattern: |
"ec2:ModifyVpcEndpointServicePermissions"
- pattern: |
"ec2:ResetSnapshotAttribute"
- pattern: |
"ecr:DeleteRepositoryPolicy"
- pattern: |
"ecr:SetRepositoryPolicy"
- pattern: |
"elasticfilesystem:DeleteFileSystemPolicy"
- pattern: |
"elasticfilesystem:PutFileSystemPolicy"
- pattern: |
"elasticmapreduce:PutBlockPublicAccessConfiguration"
- pattern: |
"es:CreateElasticsearchDomain"
- pattern: |
"es:UpdateElasticsearchDomainConfig"
- pattern: |
"glacier:AbortVaultLock"
- pattern: |
"glacier:CompleteVaultLock"
- pattern: |
"glacier:DeleteVaultAccessPolicy"
- pattern: |
"glacier:InitiateVaultLock"
- pattern: |
"glacier:SetDataRetrievalPolicy"
- pattern: |
"glacier:SetVaultAccessPolicy"
- pattern: |
"glue:DeleteResourcePolicy"
- pattern: |
"glue:PutResourcePolicy"
- pattern: |
"greengrass:AssociateServiceRoleToAccount"
- pattern: |
"health:DisableHealthServiceAccessForOrganization"
- pattern: |
"health:EnableHealthServiceAccessForOrganization"
- pattern: |
"iam:AddClientIDToOpenIDConnectProvider"
- pattern: |
"iam:AddRoleToInstanceProfile"
- pattern: |
"iam:AddUserToGroup"
- pattern: |
"iam:AttachGroupPolicy"
- pattern: |
"iam:AttachRolePolicy"
- pattern: |
"iam:AttachUserPolicy"
- pattern: |
"iam:ChangePassword"
- pattern: |
"iam:CreateAccessKey"
- pattern: |
"iam:CreateAccountAlias"
- pattern: |
"iam:CreateGroup"
- pattern: |
"iam:CreateInstanceProfile"
- pattern: |
"iam:CreateLoginProfile"
- pattern: |
"iam:CreateOpenIDConnectProvider"
- pattern: |
"iam:CreatePolicy"
- pattern: |
"iam:CreatePolicyVersion"
- pattern: |
"iam:CreateRole"
- pattern: |
"iam:CreateSAMLProvider"
- pattern: |
"iam:CreateServiceLinkedRole"
- pattern: |
"iam:CreateServiceSpecificCredential"
- pattern: |
"iam:CreateUser"
- pattern: |
"iam:CreateVirtualMFADevice"
- pattern: |
"iam:DeactivateMFADevice"
- pattern: |
"iam:DeleteAccessKey"
- pattern: |
"iam:DeleteAccountAlias"
- pattern: |
"iam:DeleteAccountPasswordPolicy"
- pattern: |
"iam:DeleteGroup"
- pattern: |
"iam:DeleteGroupPolicy"
- pattern: |
"iam:DeleteInstanceProfile"
- pattern: |
"iam:DeleteLoginProfile"
- pattern: |
"iam:DeleteOpenIDConnectProvider"
- pattern: |
"iam:DeletePolicy"
- pattern: |
"iam:DeletePolicyVersion"
- pattern: |
"iam:DeleteRole"
- pattern: |
"iam:DeleteRolePermissionsBoundary"
- pattern: |
"iam:DeleteRolePolicy"
- pattern: |
"iam:DeleteSAMLProvider"
- pattern: |
"iam:DeleteSSHPublicKey"
- pattern: |
"iam:DeleteServerCertificate"
- pattern: |
"iam:DeleteServiceLinkedRole"
- pattern: |
"iam:DeleteServiceSpecificCredential"
- pattern: |
"iam:DeleteSigningCertificate"
- pattern: |
"iam:DeleteUser"
- pattern: |
"iam:DeleteUserPermissionsBoundary"
- pattern: |
"iam:DeleteUserPolicy"
- pattern: |
"iam:DeleteVirtualMFADevice"
- pattern: |
"iam:DetachGroupPolicy"
- pattern: |
"iam:DetachRolePolicy"
- pattern: |
"iam:DetachUserPolicy"
- pattern: |
"iam:EnableMFADevice"
- pattern: |
"iam:PassRole"
- pattern: |
"iam:PutGroupPolicy"
- pattern: |
"iam:PutRolePermissionsBoundary"
- pattern: |
"iam:PutRolePolicy"
- pattern: |
"iam:PutUserPermissionsBoundary"
- pattern: |
"iam:PutUserPolicy"
- pattern: |
"iam:RemoveClientIDFromOpenIDConnectProvider"
- pattern: |
"iam:RemoveRoleFromInstanceProfile"
- pattern: |
"iam:RemoveUserFromGroup"
- pattern: |
"iam:ResetServiceSpecificCredential"
- pattern: |
"iam:ResyncMFADevice"
- pattern: |
"iam:SetDefaultPolicyVersion"
- pattern: |
"iam:SetSecurityTokenServicePreferences"
- pattern: |
"iam:UpdateAccessKey"
- pattern: |
"iam:UpdateAccountPasswordPolicy"
- pattern: |
"iam:UpdateAssumeRolePolicy"
- pattern: |
"iam:UpdateGroup"
- pattern: |
"iam:UpdateLoginProfile"
- pattern: |
"iam:UpdateOpenIDConnectProviderThumbprint"
- pattern: |
"iam:UpdateRole"
- pattern: |
"iam:UpdateRoleDescription"
- pattern: |
"iam:UpdateSAMLProvider"
- pattern: |
"iam:UpdateSSHPublicKey"
- pattern: |
"iam:UpdateServerCertificate"
- pattern: |
"iam:UpdateServiceSpecificCredential"
- pattern: |
"iam:UpdateSigningCertificate"
- pattern: |
"iam:UpdateUser"
- pattern: |
"iam:UploadSSHPublicKey"
- pattern: |
"iam:UploadServerCertificate"
- pattern: |
"iam:UploadSigningCertificate"
- pattern: |
"imagebuilder:PutComponentPolicy"
- pattern: |
"imagebuilder:PutImagePolicy"
- pattern: |
"imagebuilder:PutImageRecipePolicy"
- pattern: |
"iot:AttachPolicy"
- pattern: |
"iot:AttachPrincipalPolicy"
- pattern: |
"iot:DetachPolicy"
- pattern: |
"iot:DetachPrincipalPolicy"
- pattern: |
"iot:SetDefaultAuthorizer"
- pattern: |
"iot:SetDefaultPolicyVersion"
- pattern: |
"iotsitewise:CreateAccessPolicy"
- pattern: |
"iotsitewise:DeleteAccessPolicy"
- pattern: |
"iotsitewise:UpdateAccessPolicy"
- pattern: |
"kms:CreateGrant"
- pattern: |
"kms:PutKeyPolicy"
- pattern: |
"kms:RetireGrant"
- pattern: |
"kms:RevokeGrant"
- pattern: |
"lakeformation:BatchGrantPermissions"
- pattern: |
"lakeformation:BatchRevokePermissions"
- pattern: |
"lakeformation:GrantPermissions"
- pattern: |
"lakeformation:PutDataLakeSettings"
- pattern: |
"lakeformation:RevokePermissions"
- pattern: |
"lambda:AddLayerVersionPermission"
- pattern: |
"lambda:AddPermission"
- pattern: |
"lambda:DisableReplication"
- pattern: |
"lambda:EnableReplication"
- pattern: |
"lambda:RemoveLayerVersionPermission"
- pattern: |
"lambda:RemovePermission"
- pattern: |
"license-manager:UpdateServiceSettings"
- pattern: |
"lightsail:GetRelationalDatabaseMasterUserPassword"
- pattern: |
"logs:DeleteResourcePolicy"
- pattern: |
"logs:PutResourcePolicy"
- pattern: |
"mediapackage:RotateIngestEndpointCredentials"
- pattern: |
"mediastore:DeleteContainerPolicy"
- pattern: |
"mediastore:PutContainerPolicy"
- pattern: |
"opsworks:SetPermission"
- pattern: |
"opsworks:UpdateUserProfile"
- pattern: |
"quicksight:CreateAdmin"
- pattern: |
"quicksight:CreateGroup"
- pattern: |
"quicksight:CreateGroupMembership"
- pattern: |
"quicksight:CreateIAMPolicyAssignment"
- pattern: |
"quicksight:CreateUser"
- pattern: |
"quicksight:DeleteGroup"
- pattern: |
"quicksight:DeleteGroupMembership"
- pattern: |
"quicksight:DeleteIAMPolicyAssignment"
- pattern: |
"quicksight:DeleteUser"
- pattern: |
"quicksight:DeleteUserByPrincipalId"
- pattern: |
"quicksight:RegisterUser"
- pattern: |
"quicksight:UpdateDashboardPermissions"
- pattern: |
"quicksight:UpdateGroup"
- pattern: |
"quicksight:UpdateIAMPolicyAssignment"
- pattern: |
"quicksight:UpdateTemplatePermissions"
- pattern: |
"quicksight:UpdateUser"
- pattern: |
"ram:AcceptResourceShareInvitation"
- pattern: |
"ram:AssociateResourceShare"
- pattern: |
"ram:CreateResourceShare"
- pattern: |
"ram:DeleteResourceShare"
- pattern: |
"ram:DisassociateResourceShare"
- pattern: |
"ram:EnableSharingWithAwsOrganization"
- pattern: |
"ram:RejectResourceShareInvitation"
- pattern: |
"ram:UpdateResourceShare"
- pattern: |
"rds:AuthorizeDBSecurityGroupIngress"
- pattern: |
"rds-db:connect"
- pattern: |
"redshift:AuthorizeSnapshotAccess"
- pattern: |
"redshift:CreateClusterUser"
- pattern: |
"redshift:CreateSnapshotCopyGrant"
- pattern: |
"redshift:JoinGroup"
- pattern: |
"redshift:ModifyClusterIamRoles"
- pattern: |
"redshift:RevokeSnapshotAccess"
- pattern: |
"route53resolver:PutResolverRulePolicy"
- pattern: |
"s3:BypassGovernanceRetention"
- pattern: |
"s3:DeleteAccessPointPolicy"
- pattern: |
"s3:DeleteBucketPolicy"
- pattern: |
"s3:ObjectOwnerOverrideToBucketOwner"
- pattern: |
"s3:PutAccessPointPolicy"
- pattern: |
"s3:PutAccountPublicAccessBlock"
- pattern: |
"s3:PutBucketAcl"
- pattern: |
"s3:PutBucketPolicy"
- pattern: |
"s3:PutBucketPublicAccessBlock"
- pattern: |
"s3:PutObjectAcl"
- pattern: |
"s3:PutObjectVersionAcl"
- pattern: |
"secretsmanager:DeleteResourcePolicy"
- pattern: |
"secretsmanager:PutResourcePolicy"
- pattern: |
"secretsmanager:ValidateResourcePolicy"
- pattern: |
"servicecatalog:CreatePortfolioShare"
- pattern: |
"servicecatalog:DeletePortfolioShare"
- pattern: |
"sns:AddPermission"
- pattern: |
"sns:CreateTopic"
- pattern: |
"sns:RemovePermission"
- pattern: |
"sns:SetTopicAttributes"
- pattern: |
"sqs:AddPermission"
- pattern: |
"sqs:CreateQueue"
- pattern: |
"sqs:RemovePermission"
- pattern: |
"sqs:SetQueueAttributes"
- pattern: |
"ssm:ModifyDocumentPermission"
- pattern: |
"sso:AssociateDirectory"
- pattern: |
"sso:AssociateProfile"
- pattern: |
"sso:CreateApplicationInstance"
- pattern: |
"sso:CreateApplicationInstanceCertificate"
- pattern: |
"sso:CreatePermissionSet"
- pattern: |
"sso:CreateProfile"
- pattern: |
"sso:CreateTrust"
- pattern: |
"sso:DeleteApplicationInstance"
- pattern: |
"sso:DeleteApplicationInstanceCertificate"
- pattern: |
"sso:DeletePermissionSet"
- pattern: |
"sso:DeletePermissionsPolicy"
- pattern: |
"sso:DeleteProfile"
- pattern: |
"sso:DisassociateDirectory"
- pattern: |
"sso:DisassociateProfile"
- pattern: |
"sso:ImportApplicationInstanceServiceProviderMetadata"
- pattern: |
"sso:PutPermissionsPolicy"
- pattern: |
"sso:StartSSO"
- pattern: |
"sso:UpdateApplicationInstanceActiveCertificate"
- pattern: |
"sso:UpdateApplicationInstanceDisplayData"
- pattern: |
"sso:UpdateApplicationInstanceResponseConfiguration"
- pattern: |
"sso:UpdateApplicationInstanceResponseSchemaConfiguration"
- pattern: |
"sso:UpdateApplicationInstanceSecurityConfiguration"
- pattern: |
"sso:UpdateApplicationInstanceServiceProviderConfiguration"
- pattern: |
"sso:UpdateApplicationInstanceStatus"
- pattern: |
"sso:UpdateDirectoryAssociation"
- pattern: |
"sso:UpdatePermissionSet"
- pattern: |
"sso:UpdateProfile"
- pattern: |
"sso:UpdateSSOConfiguration"
- pattern: |
"sso:UpdateTrust"
- pattern: |
"sso-directory:AddMemberToGroup"
- pattern: |
"sso-directory:CreateAlias"
- pattern: |
"sso-directory:CreateGroup"
- pattern: |
"sso-directory:CreateUser"
- pattern: |
"sso-directory:DeleteGroup"
- pattern: |
"sso-directory:DeleteUser"
- pattern: |
"sso-directory:DisableUser"
- pattern: |
"sso-directory:EnableUser"
- pattern: |
"sso-directory:RemoveMemberFromGroup"
- pattern: |
"sso-directory:UpdateGroup"
- pattern: |
"sso-directory:UpdatePassword"
- pattern: |
"sso-directory:UpdateUser"
- pattern: |
"sso-directory:VerifyEmail"
- pattern: |
"storagegateway:DeleteChapCredentials"
- pattern: |
"storagegateway:SetLocalConsolePassword"
- pattern: |
"storagegateway:SetSMBGuestPassword"
- pattern: |
"storagegateway:UpdateChapCredentials"
- pattern: |
"waf:DeletePermissionPolicy"
- pattern: |
"waf:PutPermissionPolicy"
- pattern: |
"waf-regional:DeletePermissionPolicy"
- pattern: |
"waf-regional:PutPermissionPolicy"
- pattern: |
"wafv2:CreateWebACL"
- pattern: |
"wafv2:DeletePermissionPolicy"
- pattern: |
"wafv2:DeleteWebACL"
- pattern: |
"wafv2:PutPermissionPolicy"
- pattern: |
"wafv2:UpdateWebACL"
- pattern: |
"worklink:UpdateDevicePolicyConfiguration"
- pattern: |
"workmail:ResetPassword"
- pattern: |
"workmail:ResetUserPassword"
- pattern: |
"xray:PutEncryptionConfig"
- pattern: |
"worklink:*"
- pattern: |
"route53resolver:*"
- pattern: |
"es:*"
- pattern: |
"greengrass:*"
- pattern: |
"redshift:*"
- pattern: |
"license-manager:*"
- pattern: |
"rds:*"
- pattern: |
"lambda:*"
- pattern: |
"elasticfilesystem:*"
- pattern: |
"logs:*"
- pattern: |
"sso:*"
- pattern: |
"waf:*"
- pattern: |
"mediastore:*"
- pattern: |
"acm-pca:*"
- pattern: |
"sso-directory:*"
- pattern: |
"imagebuilder:*"
- pattern: |
"sqs:*"
- pattern: |
"codeguru-profiler:*"
- pattern: |
"wafv2:*"
- pattern: |
"cloudformation:*"
- pattern: |
"xray:*"
- pattern: |
"codeartifact:*"
- pattern: |
"iotsitewise:*"
- pattern: |
"workmail:*"
- pattern: |
"glue:*"
- pattern: |
"deeplens:*"
- pattern: |
"chime:*"
- pattern: |
"mediapackage:*"
- pattern: |
"opsworks:*"
- pattern: |
"ds:*"
- pattern: |
"ram:*"
- pattern: |
"iam:*"
- pattern: |
"waf-regional:*"
- pattern: |
"glacier:*"
- pattern: |
"cloudsearch:*"
- pattern: |
"lakeformation:*"
- pattern: |
"elasticmapreduce:*"
- pattern: |
"quicksight:*"
- pattern: |
"sns:*"
- pattern: |
"ec2:*"
- pattern: |
"health:*"
- pattern: |
"lightsail:*"
- pattern: |
"codestar:*"
- pattern: |
"kms:*"
- pattern: |
"codebuild:*"
- pattern: |
"s3:*"
- pattern: |
"cognito-identity:*"
- pattern: |
"apigateway:*"
- pattern: |
"rds-db:*"
- pattern: |
"iot:*"
- pattern: |
"backup:*"
- pattern: |
"secretsmanager:*"
- pattern: |
"servicecatalog:*"
- pattern: |
"ssm:*"
- pattern: |
"storagegateway:*"
- pattern: |
"ecr:*"
message: >-
Ensure IAM policies don't allow resource exposure. These actions can expose AWS resources to the public.
For example `ecr:SetRepositoryPolicy` could let an attacker retrieve container images. Instead,
use another action that doesn't expose AWS resources.
metadata:
references:
- https://cloudsplaining.readthedocs.io/en/latest/glossary/resource-exposure/
- https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPermissionsManagement.py
category: security
cwe:
- 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
technology:
- terraform
- aws
owasp:
- A01:2021 - Broken Access Control
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
languages: [hcl]
severity: WARNING