fix(query): fix FP results on "IAM policy allows for data exfiltration" CloudFormation and Terraform queries (#8030)

cx-andre-pereira · cx-artur-ribeiro · web-flow · commit 600c0469231b · 2026-04-22T14:46:50.000+01:00
* Added missing check/associated tests to cloudFormation and Terraform iam_policy data exfiltration queries

---------

Co-authored-by: Artur Ribeiro &lt;153724638+cx-artur-ribeiro@users.noreply.github.com&gt;
diff --git a/assets/queries/cloudFormation/aws/iam_policy_allows_for_data_exfiltration/query.rego b/assets/queries/cloudFormation/aws/iam_policy_allows_for_data_exfiltration/query.rego
@@ -3,20 +3,21 @@ package Cx
 import data.generic.common as common_lib
 import data.generic.cloudformation as cf_lib
 
-ilegal_actions := ["s3:GetObject", "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath", "secretsmanager:GetSecretValue","*","s3:*"] 
+ilegal_actions := ["s3:GetObject", "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath", "secretsmanager:GetSecretValue","*","s3:*"]
 
 CxPolicy[result] {
 	types := ["AWS::IAM::Group", "AWS::IAM::Role", "AWS::IAM::User"]
 
 	resource := input.document[i].Resources[name]
 	resource.Type == types[_]
-	
+
 	policy := resource.Properties.Policies[i2].PolicyDocument
 	st := common_lib.get_statement(common_lib.get_policy(policy))
 	statement := st[st_index]
 
 	common_lib.is_allow_effect(statement)
 	ilegal_action := is_ilegal(statement.Action)
+	common_lib.equalsOrInArray(statement.Resource, "*")
 
 	result := {
 		"documentId": input.document[i].id,
@@ -41,6 +42,7 @@ CxPolicy[result] {
 
 	common_lib.is_allow_effect(statement)
 	ilegal_action := is_ilegal(statement.Action)
+	common_lib.equalsOrInArray(statement.Resource, "*")
 
 	result := {
 		"documentId": input.document[i].id,
diff --git a/assets/queries/cloudFormation/aws/iam_policy_allows_for_data_exfiltration/test/negative11.json b/assets/queries/cloudFormation/aws/iam_policy_allows_for_data_exfiltration/test/negative11.json
@@ -0,0 +1,30 @@
+{
+  "Resources": {
+    "CFNUser": {
+      "Type": "AWS::IAM::User",
+      "Properties": {
+        "LoginProfile": {
+          "Password": "Password",
+          "PasswordResetRequired": false
+        },
+        "Policies": [
+          {
+            "PolicyName": "root",
+            "PolicyDocument": {
+              "Version": "2012-10-17",
+              "Statement": [
+                {
+                  "Effect": "Allow",
+                  "Action": [
+                    "*"
+                  ],
+                  "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Users"
+                }
+              ]
+            }
+          }
+        ]
+      }
+    }
+  }
+}
diff --git a/assets/queries/cloudFormation/aws/iam_policy_allows_for_data_exfiltration/test/negative12.yaml b/assets/queries/cloudFormation/aws/iam_policy_allows_for_data_exfiltration/test/negative12.yaml
@@ -0,0 +1,16 @@
+Resources:
+  CFNUser:
+    Type: AWS::IAM::User
+    Properties:
+      LoginProfile:
+         Password: 'Password'
+         PasswordResetRequired: false
+      Policies:
+        - PolicyName: root
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Effect: Allow
+                Action:
+                  - '*'
+                Resource: 'arn:aws:dynamodb:us-east-1:123456789012:table/Users'
diff --git a/assets/queries/cloudFormation/aws/iam_policy_allows_for_data_exfiltration/test/positive12.json b/assets/queries/cloudFormation/aws/iam_policy_allows_for_data_exfiltration/test/positive12.json
@@ -11,7 +11,7 @@
             {
               "Effect": "Allow",
               "Action": "secretsmanager:GetSecretValue",
-              "Resource": "*"
+              "Resource": ["arn:aws:dynamodb:us-east-1:123456789012:table/Users", "*"]
             }
           ]
         }
diff --git a/assets/queries/cloudFormation/aws/iam_policy_allows_for_data_exfiltration/test/positive5.yaml b/assets/queries/cloudFormation/aws/iam_policy_allows_for_data_exfiltration/test/positive5.yaml
@@ -7,7 +7,9 @@ Resources:
         Statement:
           - Effect: Allow
             Action: "s3:*"
-            Resource: "*"
+            Resource:
+             - "arn:aws:dynamodb:us-east-1:123456789012:table/Users"
+             - "*"
       Users:
         - TestUser
       Description: "Policy for creating a test database"
diff --git a/assets/queries/terraform/aws/iam_policy_allows_for_data_exfiltration/query.rego b/assets/queries/terraform/aws/iam_policy_allows_for_data_exfiltration/query.rego
@@ -14,6 +14,7 @@ CxPolicy[result] { # resources
 	statement := st[st_index]
 	common_lib.is_allow_effect(statement)
     illegal_action := is_illegal(statement.Action)
+	common_lib.equalsOrInArray(statement.Resource, "*")
 
 	result := {
 		"documentId": input.document[i].id,
@@ -37,6 +38,7 @@ CxPolicy[result] { # modules
 	statement := st[st_index]
 	common_lib.is_allow_effect(statement)
 	illegal_action := is_illegal(statement.Action)
+	common_lib.equalsOrInArray(statement.Resource, "*")
 
 	result := {
 		"documentId": input.document[i].id,
@@ -74,6 +76,7 @@ prepare_issue_data_source(statement, name, index, is_unique_element) = res {
 	not is_unique_element
 	common_lib.is_allow_effect(statement)
     illegal_action := is_illegal(statement.actions)
+	common_lib.equalsOrInArray(statement.resources, "*")
 
 	res := {
 		"sk": sprintf("aws_iam_policy_document[%s].statement[%d].actions", [name, index]),
@@ -86,6 +89,7 @@ prepare_issue_data_source(statement, name, index, is_unique_element) = res {
 	is_unique_element
 	common_lib.is_allow_effect(statement)
 	illegal_action := is_illegal(statement.actions)
+	common_lib.equalsOrInArray(statement.resources, "*")
 
 	res := {
 		"sk": sprintf("aws_iam_policy_document[%s].statement.actions", [name]),
diff --git a/assets/queries/terraform/aws/iam_policy_allows_for_data_exfiltration/test/negative13.tf b/assets/queries/terraform/aws/iam_policy_allows_for_data_exfiltration/test/negative13.tf
@@ -0,0 +1,31 @@
+resource "aws_iam_policy" "positive1" {
+  name        = "positive1_${var.environment}"
+  description = "Kai Monkey SSM Secrets Policy"
+
+  policy = <<EOF
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Sid": "KaiMonkeySSMSecretsPolicyGet",
+            "Effect": "Allow",
+            "Action": "secretsmanager:GetSecretValue",
+            "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Users"
+        },
+        {
+            "Sid": "KaiMonkeySSMSecretsPolicyGetDecrypt",
+            "Effect": "Allow",
+            "Action": [
+                "kms:Decrypt",
+                "ssm:GetParameters",
+                "ssm:GetParameter",
+                "s3:GetObject",
+                "ssm:GetParametersByPath",
+                "secretsmanager:GetSecretValue"
+            ],
+            "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Users"
+        }
+    ]
+}
+EOF
+}
diff --git a/assets/queries/terraform/aws/iam_policy_allows_for_data_exfiltration/test/positive7.tf b/assets/queries/terraform/aws/iam_policy_allows_for_data_exfiltration/test/positive7.tf
@@ -14,7 +14,7 @@ module "iam_policy" {
             "secretsmanager:GetSecretValue"
           ],
           "Effect": "Allow",
-          "Resource": "*"
+          "Resource": ["arn:aws:dynamodb:us-east-1:123456789012:table/Users", "*"]
         }
       ]
     }

Original file line number	Diff line number	Diff line change
`@@ -11,7 +11,7 @@`
`11`	`11`	`{`
`12`	`12`	`"Effect": "Allow",`
`13`	`13`	`"Action": "secretsmanager:GetSecretValue",`
`14`		`- "Resource": "*"`
	`14`	`+ "Resource": ["arn:aws:dynamodb:us-east-1:123456789012:table/Users", "*"]`
`15`	`15`	`}`
`16`	`16`	`]`
`17`	`17`	`}`
Original file line number	Diff line number	Diff line change
`@@ -14,7 +14,7 @@ module "iam_policy" {`
`14`	`14`	`"secretsmanager:GetSecretValue"`
`15`	`15`	`],`
`16`	`16`	`"Effect": "Allow",`
`17`		`- "Resource": "*"`
	`17`	`+ "Resource": ["arn:aws:dynamodb:us-east-1:123456789012:table/Users", "*"]`
`18`	`18`	`}`
`19`	`19`	`]`
`20`	`20`	`}`