Report metadata
- Account: fake<PHONE_NUMBER>22)
- Report Generated: 2020-05-16
- Cloudsplaining version: 0.1.2
Executive Summary
This report contains the security assessment results from Cloudsplaining, which maps out the IAM risk landscape in a report, identifies where resource ARN constraints are not used, and identifies other risks in IAM policies like Privilege Escalation, Resource Exposure, Infrastructure Modification, and Data Exfiltration. Remediating these issues, where necessary, will help to limit the blast radius in the case of compromised AWS credentials.
IAM Principals
The following table shows the list of IAM Users, Groups, and Roles in the account, and their associated policies.
If the policy contains IAM Actions - or combinations of actions - that fall under certain risk categories - Infrastructure Modification, Privilege Escalation, Resource Exposure, or Data Exfiltration - then the number of occurrences per-policy and per-risk is included in the table.
If the IAM principal is a Role and is assumable by a Compute Service - ec2
, ecs-tasks
, lambda
, or eks
- then that is indicated in the table as well.
Note that policies that were excluded from the scan will not have their statistics shown in the table. Please refer to the Exclusions configuration to see which ones were excluded.
|
Type |
Name |
Policy Type |
Managed By |
Policy Name |
Infrastructure Modification |
Privilege Escalation |
Resource Exposure |
Data Exfiltration |
Group Membership |
|
Group |
admin |
Inline |
Customer |
InlinePolicyForAdminGroup |
47 |
0 |
11 |
1 |
obama, userwithlotsofpermissions |
|
Group |
admin |
Managed |
AWS |
AWSLambdaFullAccess |
150 |
4 |
21 |
1 |
obama, userwithlotsofpermissions |
|
Group |
admin |
Managed |
AWS |
AdministratorAccess |
|
|
|
|
obama, userwithlotsofpermissions |
|
Role |
MyOtherRole |
Inline |
Customer |
MyOtherRolePolicy |
5 |
0 |
3 |
0 |
|
|
Role |
MyOtherRole |
Managed |
AWS |
AWSLambdaFullAccess |
150 |
4 |
21 |
1 |
|
|
Role |
MyRole |
Inline |
Customer |
EC2-IAM-example |
5 |
0 |
3 |
0 |
|
|
Role |
MyRole |
Managed |
AWS |
AWSLambdaFullAccess |
150 |
4 |
21 |
1 |
|
|
Role |
MyRole |
Managed |
AWS |
CloudWatchFullAccess |
38 |
0 |
6 |
0 |
|
|
Role |
OverprivilegedEC2 |
Inline |
Customer |
OverprivilegedEC2 |
3 |
1 |
1 |
2 |
|
|
Role |
OverprivilegedEC2 |
Managed |
Customer |
InsecurePolicy |
2 |
0 |
1 |
0 |
|
|
User |
obama |
Inline |
Customer |
InlinePolicyForAdminGroup |
47 |
0 |
11 |
1 |
admin |
|
User |
obama |
Managed |
AWS |
AWSCloudTrailFullAccess |
18 |
0 |
5 |
1 |
admin |
|
User |
obama |
Managed |
AWS |
AWSCodeCommitFullAccess |
52 |
0 |
0 |
0 |
admin |
|
User |
obama |
Managed |
AWS |
AWSLambdaFullAccess |
150 |
4 |
21 |
1 |
admin |
|
User |
obama |
Managed |
AWS |
AWSLambdaFullAccess |
150 |
4 |
21 |
1 |
admin |
|
User |
obama |
Managed |
AWS |
AdministratorAccess |
|
|
|
|
admin |
|
User |
obama |
Managed |
AWS |
AdministratorAccess |
|
|
|
|
admin |
|
User |
obama |
Managed |
AWS |
AmazonEC2FullAccess |
198 |
0 |
6 |
0 |
admin |
|
User |
obama |
Managed |
AWS |
AmazonS3FullAccess |
47 |
0 |
11 |
1 |
admin |
|
User |
obama |
Managed |
AWS |
CloudWatchFullAccess |
38 |
0 |
6 |
0 |
admin |
|
User |
userwithlotsofpermissions |
Inline |
Customer |
InlinePolicyForAdminGroup |
47 |
0 |
11 |
1 |
admin |
|
User |
userwithlotsofpermissions |
Inline |
Customer |
InsecureUserPolicy |
3 |
0 |
1 |
1 |
admin |
|
User |
userwithlotsofpermissions |
Managed |
AWS |
AWSKeyManagementServicePowerUser |
4 |
0 |
0 |
0 |
admin |
|
User |
userwithlotsofpermissions |
Managed |
AWS |
AWSLambdaFullAccess |
150 |
4 |
21 |
1 |
admin |
|
User |
userwithlotsofpermissions |
Managed |
AWS |
AdministratorAccess |
|
|
|
|
admin |
|
User |
userwithlotsofpermissions |
Managed |
AWS |
AmazonRDSFullAccess |
84 |
0 |
2 |
0 |
admin |
|
User |
userwithlotsofpermissions |
Managed |
AWS |
AmazonS3ReadOnlyAccess |
1 |
0 |
0 |
1 |
admin |
|
User |
userwithlotsofpermissions |
Managed |
AWS |
AmazonSESFullAccess |
21 |
0 |
0 |
0 |
admin |
|
User |
userwithlotsofpermissions |
Managed |
AWS |
CloudWatchFullAccess |
38 |
0 |
6 |
0 |
admin |
|
User |
userwithlotsofpermissions |
Managed |
AWS |
IAMFullAccess |
78 |
10 |
79 |
0 |
admin |
Findings: Customer-managed and inline Policies
The following table shows a list of Customer created IAM Policies that are currently used in the account - both Managed Policies and Inline Policies. If the policy is an inline policy, the table indicates the IAM Principal that the inline policy is associated with.
If the policy contains IAM Actions - or combinations of actions - that fall under certain risk categories - Infrastructure Modification, Privilege Escalation, Resource Exposure, or Data Exfiltration - then the number of occurrences per-policy and per-risk is included in the table.
If the IAM principal is a Role and is assumable by a Compute Service - ec2
, ecs-tasks
, lambda
, or eks
- then that is indicated in the table as well.
Each of the aforementioned attributes can be used to prioritize which risks to address first. For more information, see the Prioritization Guidance and Triaging Considerations. Consider using all of the Guidance criteria when reviewing this report as well.
Note that policies or IAM Principals excluded from the scan will not show up in the table at all. Please refer to the Exclusions configuration to see which ones were excluded. To view the list of IAM Principals and their associated policies, see the IAM Principals Tab.
In-depth analysis: Customer-managed and inline Policies
Services: 2
Infrastructure Modification Actions: 5
{
"Statement": [
{
"Action": [
"iam:CreateInstanceProfile",
"iam:ListInstanceProfilesForRole",
"iam:PassRole",
"ec2:DescribeIamInstanceProfileAssociations",
"iam:GetInstanceProfile",
"ec2:DisassociateIamInstanceProfile",
"ec2:AssociateIamInstanceProfile",
"iam:AddRoleToInstanceProfile"
],
"Effect": "Allow",
"Resource": "*",
"Sid": "VisualEditor0"
}
],
"Version": "2012-10-17"
}
[
"ec2:AssociateIamInstanceProfile",
"ec2:DisassociateIamInstanceProfile",
"iam:AddRoleToInstanceProfile",
"iam:CreateInstanceProfile",
"iam:PassRole"
]
{
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": "ssm.amazonaws.com"
}
}
],
"Version": "2012-10-17"
}
Resource Exposure actions [link]
[
"iam:AddRoleToInstanceProfile",
"iam:CreateInstanceProfile",
"iam:PassRole"
]
Services: 1
Infrastructure Modification Actions: 47
{
"Statement": [
{
"Action": [
"s3:*"
],
"Effect": "Allow",
"Resource": "*",
"Sid": "VisualEditor0"
}
],
"Version": "2012-10-17"
}
[
"s3:AbortMultipartUpload",
"s3:BypassGovernanceRetention",
"s3:CreateAccessPoint",
"s3:CreateBucket",
"s3:DeleteAccessPoint",
"s3:DeleteAccessPointPolicy",
"s3:DeleteBucket",
"s3:DeleteBucketPolicy",
"s3:DeleteBucketWebsite",
"s3:DeleteObject",
"s3:DeleteObjectTagging",
"s3:DeleteObjectVersion",
"s3:DeleteObjectVersionTagging",
"s3:GetObject",
"s3:ObjectOwnerOverrideToBucketOwner",
"s3:PutAccelerateConfiguration",
"s3:PutAccessPointPolicy",
"s3:PutAnalyticsConfiguration",
"s3:PutBucketAcl",
"s3:PutBucketCORS",
"s3:PutBucketLogging",
"s3:PutBucketNotification",
"s3:PutBucketObjectLockConfiguration",
"s3:PutBucketPolicy",
"s3:PutBucketPublicAccessBlock",
"s3:PutBucketRequestPayment",
"s3:PutBucketTagging",
"s3:PutBucketVersioning",
"s3:PutBucketWebsite",
"s3:PutEncryptionConfiguration",
"s3:PutInventoryConfiguration",
"s3:PutLifecycleConfiguration",
"s3:PutMetricsConfiguration",
"s3:PutObject",
"s3:PutObjectAcl",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionAcl",
"s3:PutObjectVersionTagging",
"s3:PutReplicationConfiguration",
"s3:ReplicateDelete",
"s3:ReplicateObject",
"s3:ReplicateTags",
"s3:RestoreObject",
"s3:UpdateJobPriority",
"s3:UpdateJobStatus"
]
Data Exfiltration actions [link]
[
"s3:GetObject"
]
Resource Exposure actions [link]
[
"s3:BypassGovernanceRetention",
"s3:DeleteAccessPointPolicy",
"s3:DeleteBucketPolicy",
"s3:ObjectOwnerOverrideToBucketOwner",
"s3:PutAccessPointPolicy",
"s3:PutAccountPublicAccessBlock",
"s3:PutBucketAcl",
"s3:PutBucketPolicy",
"s3:PutBucketPublicAccessBlock",
"s3:PutObjectAcl",
"s3:PutObjectVersionAcl"
]
Services: 1
Infrastructure Modification Actions: 2
{
"Statement": [
{
"Action": [
"s3:PutObject",
"s3:PutObjectAcl"
],
"Effect": "Allow",
"Resource": [
"*"
],
"Sid": "VisualEditor0"
}
],
"Version": "2012-10-17"
}
[
"s3:PutObject",
"s3:PutObjectAcl"
]
Resource Exposure actions [link]
[
"s3:PutObjectAcl"
]
Services: 1
Infrastructure Modification Actions: 3
{
"Statement": [
{
"Action": [
"s3:PutObject",
"s3:PutObjectAcl",
"s3:GetObject"
],
"Effect": "Allow",
"Resource": [
"*"
],
"Sid": "VisualEditor0"
}
],
"Version": "2012-10-17"
}
[
"s3:GetObject",
"s3:PutObject",
"s3:PutObjectAcl"
]
Data Exfiltration actions [link]
[
"s3:GetObject"
]
Resource Exposure actions [link]
[
"s3:PutObjectAcl"
]
Services: 2
Infrastructure Modification Actions: 5
Role Assumable by Service(s): ec2
{
"Statement": [
{
"Action": [
"iam:CreateInstanceProfile",
"iam:ListInstanceProfilesForRole",
"iam:PassRole",
"ec2:DescribeIamInstanceProfileAssociations",
"iam:GetInstanceProfile",
"ec2:DisassociateIamInstanceProfile",
"ec2:AssociateIamInstanceProfile",
"iam:AddRoleToInstanceProfile"
],
"Effect": "Allow",
"Resource": "*",
"Sid": "VisualEditor0"
}
],
"Version": "2012-10-17"
}
[
"ec2:AssociateIamInstanceProfile",
"ec2:DisassociateIamInstanceProfile",
"iam:AddRoleToInstanceProfile",
"iam:CreateInstanceProfile",
"iam:PassRole"
]
{
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
}
}
],
"Version": "2012-10-17"
}
Assumable by Compute Services
[link]
- ec2
Resource Exposure actions [link]
[
"iam:AddRoleToInstanceProfile",
"iam:CreateInstanceProfile",
"iam:PassRole"
]
Services: 3
Infrastructure Modification Actions: 3
Role Assumable by Service(s): ec2
{
"Statement": [
{
"Action": [
"secretsmanager:GetSecretValue",
"s3:GetObject",
"iam:CreateAccessKey"
],
"Effect": "Allow",
"Resource": "*",
"Sid": "VisualEditor0"
}
],
"Version": "2012-10-17"
}
[
"iam:CreateAccessKey",
"s3:GetObject",
"secretsmanager:GetSecretValue"
]
{
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
}
}
],
"Version": "2012-10-17"
}
Assumable by Compute Services
[link]
- ec2
Privilege Escalation methods
[link]
- Method: CreateAccessKey
Actions:
- iam:createaccesskey
Data Exfiltration actions [link]
[
"s3:GetObject",
"secretsmanager:GetSecretValue"
]
Resource Exposure actions [link]
[
"iam:CreateAccessKey"
]
Findings: AWS-managed Policies
The following table shows a list of AWS-managed IAM Policies that are currently used in the account.
If the policy contains IAM Actions - or combinations of actions - that fall under certain risk categories - Infrastructure Modification, Privilege Escalation, Resource Exposure, or Data Exfiltration - then the number of occurrences per-policy and per-risk is included in the table.
Each of the aforementioned attributes can be used to prioritize which risks to address first. For more information, see the Prioritization Guidance and Triaging Considerations. Consider using all of the Guidance criteria when reviewing this report as well.
Note that policies or IAM Principals excluded from the scan will not show up in the table at all. Please refer to the Exclusions configuration to see which ones were excluded. To view the list of IAM Principals and their associated policies, see the IAM Principals Tab.
|
Policy Name |
Services Count |
Services Affected |
Infrastructure Modification |
Privilege Escalation |
Resource Exposure |
Data Exfiltration |
|
AWSCloudTrailFullAccess |
4 |
cloudtrail, iam, s3, sns |
18 |
|
5 |
1 |
|
AWSCodeCommitFullAccess |
4 |
codecommit, codeguru-reviewer, codestar-notifications, events |
52 |
|
|
|
|
AWSKeyManagementServicePowerUser |
1 |
kms |
4 |
|
|
|
|
AWSLambdaFullAccess |
12 |
cloudwatch, cognito-sync, dynamodb, events, iam, iot, kinesis, lambda, logs, s3, sns, sqs |
150 |
4 |
21 |
1 |
|
AmazonEC2FullAccess |
5 |
autoscaling, cloudwatch, ec2, elasticloadbalancing, iam |
198 |
|
6 |
|
|
AmazonRDSFullAccess |
4 |
cloudwatch, iam, rds, sns |
84 |
|
2 |
|
|
AmazonS3FullAccess |
1 |
s3 |
47 |
|
11 |
1 |
|
AmazonS3ReadOnlyAccess |
1 |
s3 |
1 |
|
|
1 |
|
AmazonSESFullAccess |
1 |
ses |
21 |
|
|
|
|
CloudWatchFullAccess |
3 |
cloudwatch, logs, sns |
38 |
|
6 |
|
|
IAMFullAccess |
1 |
iam |
78 |
10 |
79 |
|
In-depth analysis: AWS-managed Policies
Services: 4
Infrastructure Modification Actions: 18
{
"Statement": [
{
"Action": [
"sns:AddPermission",
"sns:CreateTopic",
"sns:DeleteTopic",
"sns:ListTopics",
"sns:SetTopicAttributes",
"sns:GetTopicAttributes"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"s3:CreateBucket",
"s3:DeleteBucket",
"s3:ListAllMyBuckets",
"s3:PutBucketPolicy",
"s3:ListBucket",
"s3:GetObject",
"s3:GetBucketLocation",
"s3:GetBucketPolicy"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": "cloudtrail:*",
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"logs:CreateLogGroup"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"iam:ListRoles",
"iam:GetRolePolicy",
"iam:GetUser"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"iam:PassRole"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": "cloudtrail.amazonaws.com"
}
},
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"kms:ListKeys",
"kms:ListAliases"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"lambda:ListFunctions"
],
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
}
[
"cloudtrail:AddTags",
"cloudtrail:CreateTrail",
"cloudtrail:DeleteTrail",
"cloudtrail:PutEventSelectors",
"cloudtrail:PutInsightSelectors",
"cloudtrail:RemoveTags",
"cloudtrail:StartLogging",
"cloudtrail:StopLogging",
"cloudtrail:UpdateTrail",
"iam:PassRole",
"s3:CreateBucket",
"s3:DeleteBucket",
"s3:GetObject",
"s3:PutBucketPolicy",
"sns:AddPermission",
"sns:CreateTopic",
"sns:DeleteTopic",
"sns:SetTopicAttributes"
]
Data Exfiltration actions [link]
[
"s3:GetObject"
]
Resource Exposure actions [link]
[
"sns:AddPermission",
"sns:CreateTopic",
"sns:SetTopicAttributes",
"s3:PutBucketPolicy",
"iam:PassRole"
]
Services: 4
Infrastructure Modification Actions: 52
{
"Statement": [
{
"Action": [
"codecommit:*"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"events:DeleteRule",
"events:DescribeRule",
"events:DisableRule",
"events:EnableRule",
"events:PutRule",
"events:PutTargets",
"events:RemoveTargets",
"events:ListTargetsByRule"
],
"Effect": "Allow",
"Resource": "arn:aws:events:*:*:rule/codecommit*",
"Sid": "CloudWatchEventsCodeCommitRulesAccess"
},
{
"Action": [
"sns:CreateTopic",
"sns:DeleteTopic",
"sns:Subscribe",
"sns:Unsubscribe",
"sns:SetTopicAttributes"
],
"Effect": "Allow",
"Resource": "arn:aws:sns:*:*:codecommit*",
"Sid": "SNSTopicAndSubscriptionAccess"
},
{
"Action": [
"sns:ListTopics",
"sns:ListSubscriptionsByTopic",
"sns:GetTopicAttributes"
],
"Effect": "Allow",
"Resource": "*",
"Sid": "SNSTopicAndSubscriptionReadAccess"
},
{
"Action": [
"lambda:ListFunctions"
],
"Effect": "Allow",
"Resource": "*",
"Sid": "LambdaReadOnlyListAccess"
},
{
"Action": [
"iam:ListUsers"
],
"Effect": "Allow",
"Resource": "*",
"Sid": "IAMReadOnlyListAccess"
},
{
"Action": [
"iam:ListAccessKeys",
"iam:ListSSHPublicKeys",
"iam:ListServiceSpecificCredentials"
],
"Effect": "Allow",
"Resource": "arn:aws:iam::*:user/${aws:username}",
"Sid": "IAMReadOnlyConsoleAccess"
},
{
"Action": [
"iam:DeleteSSHPublicKey",
"iam:GetSSHPublicKey",
"iam:ListSSHPublicKeys",
"iam:UpdateSSHPublicKey",
"iam:UploadSSHPublicKey"
],
"Effect": "Allow",
"Resource": "arn:aws:iam::*:user/${aws:username}",
"Sid": "IAMUserSSHKeys"
},
{
"Action": [
"iam:CreateServiceSpecificCredential",
"iam:UpdateServiceSpecificCredential",
"iam:DeleteServiceSpecificCredential",
"iam:ResetServiceSpecificCredential"
],
"Effect": "Allow",
"Resource": "arn:aws:iam::*:user/${aws:username}",
"Sid": "IAMSelfManageServiceSpecificCredentials"
},
{
"Action": [
"codestar-notifications:CreateNotificationRule",
"codestar-notifications:DescribeNotificationRule",
"codestar-notifications:UpdateNotificationRule",
"codestar-notifications:DeleteNotificationRule",
"codestar-notifications:Subscribe",
"codestar-notifications:Unsubscribe"
],
"Condition": {
"StringLike": {
"codestar-notifications:NotificationsForResource": "arn:aws:codecommit:*"
}
},
"Effect": "Allow",
"Resource": "*",
"Sid": "CodeStarNotificationsReadWriteAccess"
},
{
"Action": [
"codestar-notifications:ListNotificationRules",
"codestar-notifications:ListTargets",
"codestar-notifications:ListTagsforResource",
"codestar-notifications:ListEventTypes"
],
"Effect": "Allow",
"Resource": "*",
"Sid": "CodeStarNotificationsListAccess"
},
{
"Action": [
"sns:CreateTopic",
"sns:SetTopicAttributes"
],
"Effect": "Allow",
"Resource": "arn:aws:sns:*:*:codestar-notifications*",
"Sid": "CodeStarNotificationsSNSTopicCreateAccess"
},
{
"Action": [
"codeguru-reviewer:AssociateRepository",
"codeguru-reviewer:DescribeRepositoryAssociation",
"codeguru-reviewer:ListRepositoryAssociations",
"codeguru-reviewer:DisassociateRepository"
],
"Effect": "Allow",
"Resource": "*",
"Sid": "AmazonCodeGuruReviewerFullAccess"
},
{
"Action": "iam:CreateServiceLinkedRole",
"Condition": {
"StringLike": {
"iam:AWSServiceName": "codeguru-reviewer.amazonaws.com"
}
},
"Effect": "Allow",
"Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer",
"Sid": "AmazonCodeGuruReviewerSLRCreation"
},
{
"Action": [
"events:PutRule",
"events:PutTargets",
"events:DeleteRule",
"events:RemoveTargets"
],
"Condition": {
"StringEquals": {
"events:ManagedBy": "codeguru-reviewer.amazonaws.com"
}
},
"Effect": "Allow",
"Resource": "*",
"Sid": "CloudWatchEventsManagedRules"
},
{
"Action": [
"chatbot:DescribeSlackChannelConfigurations"
],
"Effect": "Allow",
"Resource": "*",
"Sid": "CodeStarNotificationsChatbotAccess"
}
],
"Version": "2012-10-17"
}
[
"codecommit:AssociateApprovalRuleTemplateWithRepository",
"codecommit:BatchAssociateApprovalRuleTemplateWithRepositories",
"codecommit:BatchDisassociateApprovalRuleTemplateFromRepositories",
"codecommit:CreateBranch",
"codecommit:CreateCommit",
"codecommit:CreatePullRequest",
"codecommit:CreatePullRequestApprovalRule",
"codecommit:CreateRepository",
"codecommit:CreateUnreferencedMergeCommit",
"codecommit:DeleteBranch",
"codecommit:DeleteCommentContent",
"codecommit:DeleteFile",
"codecommit:DeletePullRequestApprovalRule",
"codecommit:DeleteRepository",
"codecommit:DisassociateApprovalRuleTemplateFromRepository",
"codecommit:GitPush",
"codecommit:MergeBranchesByFastForward",
"codecommit:MergeBranchesBySquash",
"codecommit:MergeBranchesByThreeWay",
"codecommit:MergePullRequestByFastForward",
"codecommit:MergePullRequestBySquash",
"codecommit:MergePullRequestByThreeWay",
"codecommit:OverridePullRequestApprovalRules",
"codecommit:PostCommentForComparedCommit",
"codecommit:PostCommentForPullRequest",
"codecommit:PostCommentReply",
"codecommit:PutFile",
"codecommit:PutRepositoryTriggers",
"codecommit:TagResource",
"codecommit:TestRepositoryTriggers",
"codecommit:UntagResource",
"codecommit:UpdateComment",
"codecommit:UpdateDefaultBranch",
"codecommit:UpdatePullRequestApprovalRuleContent",
"codecommit:UpdatePullRequestApprovalState",
"codecommit:UpdatePullRequestDescription",
"codecommit:UpdatePullRequestStatus",
"codecommit:UpdatePullRequestTitle",
"codecommit:UpdateRepositoryDescription",
"codecommit:UpdateRepositoryName",
"codecommit:UploadArchive",
"codeguru-reviewer:AssociateRepository",
"codeguru-reviewer:DisassociateRepository",
"codestar-notifications:CreateNotificationRule",
"codestar-notifications:DeleteNotificationRule",
"codestar-notifications:Subscribe",
"codestar-notifications:Unsubscribe",
"codestar-notifications:UpdateNotificationRule",
"events:DeleteRule",
"events:PutRule",
"events:PutTargets",
"events:RemoveTargets"
]
Services: 1
Infrastructure Modification Actions: 4
{
"Statement": [
{
"Action": [
"kms:CreateAlias",
"kms:CreateKey",
"kms:DeleteAlias",
"kms:Describe*",
"kms:GenerateRandom",
"kms:Get*",
"kms:List*",
"kms:TagResource",
"kms:UntagResource",
"iam:ListGroups",
"iam:ListRoles",
"iam:ListUsers"
],
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
}
- userwithlotsofpermissions
[
"kms:CreateAlias",
"kms:DeleteAlias",
"kms:TagResource",
"kms:UntagResource"
]
Services: 12
Infrastructure Modification Actions: 150
{
"Statement": [
{
"Action": [
"cloudformation:DescribeChangeSet",
"cloudformation:DescribeStackResources",
"cloudformation:DescribeStacks",
"cloudformation:GetTemplate",
"cloudformation:ListStackResources",
"cloudwatch:*",
"cognito-identity:ListIdentityPools",
"cognito-sync:GetCognitoEvents",
"cognito-sync:SetCognitoEvents",
"dynamodb:*",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"ec2:DescribeVpcs",
"events:*",
"iam:GetPolicy",
"iam:GetPolicyVersion",
"iam:GetRole",
"iam:GetRolePolicy",
"iam:ListAttachedRolePolicies",
"iam:ListRolePolicies",
"iam:ListRoles",
"iam:PassRole",
"iot:AttachPrincipalPolicy",
"iot:AttachThingPrincipal",
"iot:CreateKeysAndCertificate",
"iot:CreatePolicy",
"iot:CreateThing",
"iot:CreateTopicRule",
"iot:DescribeEndpoint",
"iot:GetTopicRule",
"iot:ListPolicies",
"iot:ListThings",
"iot:ListTopicRules",
"iot:ReplaceTopicRule",
"kinesis:DescribeStream",
"kinesis:ListStreams",
"kinesis:PutRecord",
"kms:ListAliases",
"lambda:*",
"logs:*",
"s3:*",
"sns:ListSubscriptions",
"sns:ListSubscriptionsByTopic",
"sns:ListTopics",
"sns:Publish",
"sns:Subscribe",
"sns:Unsubscribe",
"sqs:ListQueues",
"sqs:SendMessage",
"tag:GetResources",
"xray:PutTelemetryRecords",
"xray:PutTraceSegments"
],
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
}
- admin
- MyOtherRole
- MyRole
- obama
- userwithlotsofpermissions
[
"cloudwatch:DeleteAlarms",
"cloudwatch:DeleteDashboards",
"cloudwatch:DeleteInsightRules",
"cloudwatch:DisableAlarmActions",
"cloudwatch:DisableInsightRules",
"cloudwatch:EnableAlarmActions",
"cloudwatch:EnableInsightRules",
"cloudwatch:PutDashboard",
"cloudwatch:PutInsightRule",
"cloudwatch:PutMetricAlarm",
"cloudwatch:SetAlarmState",
"cloudwatch:TagResource",
"cloudwatch:UntagResource",
"cognito-sync:SetCognitoEvents",
"dynamodb:BatchWriteItem",
"dynamodb:CreateBackup",
"dynamodb:CreateGlobalTable",
"dynamodb:CreateTable",
"dynamodb:CreateTableReplica",
"dynamodb:DeleteBackup",
"dynamodb:DeleteItem",
"dynamodb:DeleteTable",
"dynamodb:DeleteTableReplica",
"dynamodb:PutItem",
"dynamodb:RestoreTableFromBackup",
"dynamodb:RestoreTableToPointInTime",
"dynamodb:TagResource",
"dynamodb:UntagResource",
"dynamodb:UpdateContinuousBackups",
"dynamodb:UpdateContributorInsights",
"dynamodb:UpdateGlobalTable",
"dynamodb:UpdateGlobalTableSettings",
"dynamodb:UpdateItem",
"dynamodb:UpdateTable",
"dynamodb:UpdateTableReplicaAutoScaling",
"dynamodb:UpdateTimeToLive",
"events:ActivateEventSource",
"events:CreateEventBus",
"events:CreatePartnerEventSource",
"events:DeactivateEventSource",
"events:DeleteEventBus",
"events:DeletePartnerEventSource",
"events:DeleteRule",
"events:DisableRule",
"events:EnableRule",
"events:PutRule",
"events:PutTargets",
"events:RemoveTargets",
"events:TagResource",
"events:UntagResource",
"iam:PassRole",
"iot:AttachPrincipalPolicy",
"iot:CreateThing",
"iot:CreateTopicRule",
"iot:ReplaceTopicRule",
"kinesis:PutRecord",
"lambda:AddLayerVersionPermission",
"lambda:AddPermission",
"lambda:CreateAlias",
"lambda:CreateFunction",
"lambda:DeleteAlias",
"lambda:DeleteEventSourceMapping",
"lambda:DeleteFunction",
"lambda:DeleteFunctionConcurrency",
"lambda:DeleteFunctionEventInvokeConfig",
"lambda:DeleteLayerVersion",
"lambda:DeleteProvisionedConcurrencyConfig",
"lambda:DisableReplication",
"lambda:EnableReplication",
"lambda:InvokeAsync",
"lambda:InvokeFunction",
"lambda:PublishLayerVersion",
"lambda:PublishVersion",
"lambda:PutFunctionConcurrency",
"lambda:PutFunctionEventInvokeConfig",
"lambda:PutProvisionedConcurrencyConfig",
"lambda:RemoveLayerVersionPermission",
"lambda:RemovePermission",
"lambda:TagResource",
"lambda:UntagResource",
"lambda:UpdateAlias",
"lambda:UpdateEventSourceMapping",
"lambda:UpdateFunctionCode",
"lambda:UpdateFunctionConfiguration",
"lambda:UpdateFunctionEventInvokeConfig",
"logs:AssociateKmsKey",
"logs:CreateExportTask",
"logs:CreateLogStream",
"logs:DeleteLogGroup",
"logs:DeleteLogStream",
"logs:DeleteMetricFilter",
"logs:DeleteRetentionPolicy",
"logs:DeleteSubscriptionFilter",
"logs:DisassociateKmsKey",
"logs:PutLogEvents",
"logs:PutMetricFilter",
"logs:PutRetentionPolicy",
"logs:PutSubscriptionFilter",
"logs:TagLogGroup",
"logs:UntagLogGroup",
"s3:AbortMultipartUpload",
"s3:BypassGovernanceRetention",
"s3:CreateAccessPoint",
"s3:CreateBucket",
"s3:DeleteAccessPoint",
"s3:DeleteAccessPointPolicy",
"s3:DeleteBucket",
"s3:DeleteBucketPolicy",
"s3:DeleteBucketWebsite",
"s3:DeleteObject",
"s3:DeleteObjectTagging",
"s3:DeleteObjectVersion",
"s3:DeleteObjectVersionTagging",
"s3:GetObject",
"s3:ObjectOwnerOverrideToBucketOwner",
"s3:PutAccelerateConfiguration",
"s3:PutAccessPointPolicy",
"s3:PutAnalyticsConfiguration",
"s3:PutBucketAcl",
"s3:PutBucketCORS",
"s3:PutBucketLogging",
"s3:PutBucketNotification",
"s3:PutBucketObjectLockConfiguration",
"s3:PutBucketPolicy",
"s3:PutBucketPublicAccessBlock",
"s3:PutBucketRequestPayment",
"s3:PutBucketTagging",
"s3:PutBucketVersioning",
"s3:PutBucketWebsite",
"s3:PutEncryptionConfiguration",
"s3:PutInventoryConfiguration",
"s3:PutLifecycleConfiguration",
"s3:PutMetricsConfiguration",
"s3:PutObject",
"s3:PutObjectAcl",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionAcl",
"s3:PutObjectVersionTagging",
"s3:PutReplicationConfiguration",
"s3:ReplicateDelete",
"s3:ReplicateObject",
"s3:ReplicateTags",
"s3:RestoreObject",
"s3:UpdateJobPriority",
"s3:UpdateJobStatus",
"sns:Publish",
"sns:Subscribe",
"sqs:SendMessage"
]
Privilege Escalation methods
[link]
- Method: PassExistingRoleToNewLambdaThenInvoke
Actions:
- iam:passrole
- lambda:createfunction
- lambda:invokefunction
- Method: PassExistingRoleToNewLambdaThenTriggerWithNewDynamo
Actions:
- iam:passrole
- lambda:createfunction
- lambda:createeventsourcemapping
- dynamodb:createtable
- dynamodb:putitem
- Method: PassExistingRoleToNewLambdaThenTriggerWithExistingDynamo
Actions:
- iam:passrole
- lambda:createfunction
- lambda:createeventsourcemapping
- Method: EditExistingLambdaFunctionWithRole
Actions:
- lambda:updatefunctioncode
Data Exfiltration actions [link]
[
"s3:GetObject"
]
Resource Exposure actions [link]
[
"iam:PassRole",
"iot:AttachPrincipalPolicy",
"lambda:AddLayerVersionPermission",
"lambda:AddPermission",
"lambda:DisableReplication",
"lambda:EnableReplication",
"lambda:RemoveLayerVersionPermission",
"lambda:RemovePermission",
"logs:DeleteResourcePolicy",
"logs:PutResourcePolicy",
"s3:BypassGovernanceRetention",
"s3:DeleteAccessPointPolicy",
"s3:DeleteBucketPolicy",
"s3:ObjectOwnerOverrideToBucketOwner",
"s3:PutAccessPointPolicy",
"s3:PutAccountPublicAccessBlock",
"s3:PutBucketAcl",
"s3:PutBucketPolicy",
"s3:PutBucketPublicAccessBlock",
"s3:PutObjectAcl",
"s3:PutObjectVersionAcl"
]
Services: 5
Infrastructure Modification Actions: 198
{
"Statement": [
{
"Action": "ec2:*",
"Effect": "Allow",
"Resource": "*"
},
{
"Action": "elasticloadbalancing:*",
"Effect": "Allow",
"Resource": "*"
},
{
"Action": "cloudwatch:*",
"Effect": "Allow",
"Resource": "*"
},
{
"Action": "autoscaling:*",
"Effect": "Allow",
"Resource": "*"
},
{
"Action": "iam:CreateServiceLinkedRole",
"Condition": {
"StringEquals": {
"iam:AWSServiceName": [
"autoscaling.amazonaws.com",
"ec2scheduled.amazonaws.com",
"elasticloadbalancing.amazonaws.com",
"spot.amazonaws.com",
"spotfleet.amazonaws.com",
"transitgateway.amazonaws.com"
]
}
},
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
}
[
"autoscaling:AttachInstances",
"autoscaling:AttachLoadBalancerTargetGroups",
"autoscaling:AttachLoadBalancers",
"autoscaling:BatchDeleteScheduledAction",
"autoscaling:BatchPutScheduledUpdateGroupAction",
"autoscaling:CompleteLifecycleAction",
"autoscaling:CreateAutoScalingGroup",
"autoscaling:CreateLaunchConfiguration",
"autoscaling:CreateOrUpdateTags",
"autoscaling:DeleteAutoScalingGroup",
"autoscaling:DeleteLaunchConfiguration",
"autoscaling:DeleteLifecycleHook",
"autoscaling:DeleteNotificationConfiguration",
"autoscaling:DeletePolicy",
"autoscaling:DeleteScheduledAction",
"autoscaling:DeleteTags",
"autoscaling:DetachInstances",
"autoscaling:DetachLoadBalancerTargetGroups",
"autoscaling:DetachLoadBalancers",
"autoscaling:DisableMetricsCollection",
"autoscaling:EnableMetricsCollection",
"autoscaling:EnterStandby",
"autoscaling:ExecutePolicy",
"autoscaling:ExitStandby",
"autoscaling:PutLifecycleHook",
"autoscaling:PutNotificationConfiguration",
"autoscaling:PutScalingPolicy",
"autoscaling:PutScheduledUpdateGroupAction",
"autoscaling:RecordLifecycleActionHeartbeat",
"autoscaling:ResumeProcesses",
"autoscaling:SetDesiredCapacity",
"autoscaling:SetInstanceHealth",
"autoscaling:SetInstanceProtection",
"autoscaling:SuspendProcesses",
"autoscaling:TerminateInstanceInAutoScalingGroup",
"autoscaling:UpdateAutoScalingGroup",
"cloudwatch:DeleteAlarms",
"cloudwatch:DeleteDashboards",
"cloudwatch:DeleteInsightRules",
"cloudwatch:DisableAlarmActions",
"cloudwatch:DisableInsightRules",
"cloudwatch:EnableAlarmActions",
"cloudwatch:EnableInsightRules",
"cloudwatch:PutDashboard",
"cloudwatch:PutInsightRule",
"cloudwatch:PutMetricAlarm",
"cloudwatch:SetAlarmState",
"cloudwatch:TagResource",
"cloudwatch:UntagResource",
"ec2:AcceptTransitGatewayPeeringAttachment",
"ec2:AcceptTransitGatewayVpcAttachment",
"ec2:AcceptVpcEndpointConnections",
"ec2:AcceptVpcPeeringConnection",
"ec2:AllocateHosts",
"ec2:ApplySecurityGroupsToClientVpnTargetNetwork",
"ec2:AssociateClientVpnTargetNetwork",
"ec2:AssociateIamInstanceProfile",
"ec2:AssociateTransitGatewayMulticastDomain",
"ec2:AssociateTransitGatewayRouteTable",
"ec2:AttachClassicLinkVpc",
"ec2:AttachVolume",
"ec2:AuthorizeClientVpnIngress",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:CancelCapacityReservation",
"ec2:CopySnapshot",
"ec2:CreateClientVpnEndpoint",
"ec2:CreateClientVpnRoute",
"ec2:CreateFlowLogs",
"ec2:CreateLaunchTemplateVersion",
"ec2:CreateLocalGatewayRoute",
"ec2:CreateLocalGatewayRouteTableVpcAssociation",
"ec2:CreateNetworkInterfacePermission",
"ec2:CreateRoute",
"ec2:CreateSnapshot",
"ec2:CreateSnapshots",
"ec2:CreateTags",
"ec2:CreateTrafficMirrorFilter",
"ec2:CreateTrafficMirrorFilterRule",
"ec2:CreateTrafficMirrorSession",
"ec2:CreateTrafficMirrorTarget",
"ec2:CreateTransitGateway",
"ec2:CreateTransitGatewayMulticastDomain",
"ec2:CreateTransitGatewayPeeringAttachment",
"ec2:CreateTransitGatewayRoute",
"ec2:CreateTransitGatewayRouteTable",
"ec2:CreateTransitGatewayVpcAttachment",
"ec2:CreateVolume",
"ec2:CreateVpcEndpoint",
"ec2:CreateVpcEndpointServiceConfiguration",
"ec2:CreateVpcPeeringConnection",
"ec2:CreateVpnConnection",
"ec2:DeleteClientVpnEndpoint",
"ec2:DeleteClientVpnRoute",
"ec2:DeleteCustomerGateway",
"ec2:DeleteDhcpOptions",
"ec2:DeleteInternetGateway",
"ec2:DeleteLaunchTemplate",
"ec2:DeleteLaunchTemplateVersions",
"ec2:DeleteLocalGatewayRoute",
"ec2:DeleteLocalGatewayRouteTableVpcAssociation",
"ec2:DeleteNetworkAcl",
"ec2:DeleteNetworkAclEntry",
"ec2:DeleteRoute",
"ec2:DeleteRouteTable",
"ec2:DeleteSecurityGroup",
"ec2:DeleteSnapshot",
"ec2:DeleteTags",
"ec2:DeleteTrafficMirrorFilter",
"ec2:DeleteTrafficMirrorFilterRule",
"ec2:DeleteTrafficMirrorSession",
"ec2:DeleteTrafficMirrorTarget",
"ec2:DeleteTransitGateway",
"ec2:DeleteTransitGatewayMulticastDomain",
"ec2:DeleteTransitGatewayPeeringAttachment",
"ec2:DeleteTransitGatewayRoute",
"ec2:DeleteTransitGatewayRouteTable",
"ec2:DeleteTransitGatewayVpcAttachment",
"ec2:DeleteVolume",
"ec2:DeleteVpcEndpointServiceConfigurations",
"ec2:DeleteVpcEndpoints",
"ec2:DeleteVpcPeeringConnection",
"ec2:DeregisterTransitGatewayMulticastGroupMembers",
"ec2:DeregisterTransitGatewayMulticastGroupSources",
"ec2:DetachClassicLinkVpc",
"ec2:DetachVolume",
"ec2:DisableFastSnapshotRestores",
"ec2:DisableTransitGatewayRouteTablePropagation",
"ec2:DisableVpcClassicLink",
"ec2:DisassociateClientVpnTargetNetwork",
"ec2:DisassociateIamInstanceProfile",
"ec2:DisassociateTransitGatewayMulticastDomain",
"ec2:DisassociateTransitGatewayRouteTable",
"ec2:EnableFastSnapshotRestores",
"ec2:EnableTransitGatewayRouteTablePropagation",
"ec2:EnableVpcClassicLink",
"ec2:ImportClientVpnClientCertificateRevocationList",
"ec2:ModifyCapacityReservation",
"ec2:ModifyClientVpnEndpoint",
"ec2:ModifyInstanceCreditSpecification",
"ec2:ModifyInstanceEventStartTime",
"ec2:ModifyLaunchTemplate",
"ec2:ModifySnapshotAttribute",
"ec2:ModifyTrafficMirrorFilterNetworkServices",
"ec2:ModifyTrafficMirrorFilterRule",
"ec2:ModifyTrafficMirrorSession",
"ec2:ModifyTransitGatewayVpcAttachment",
"ec2:ModifyVpcEndpoint",
"ec2:ModifyVpcEndpointServiceConfiguration",
"ec2:ModifyVpcEndpointServicePermissions",
"ec2:ModifyVpnConnection",
"ec2:ModifyVpnTunnelOptions",
"ec2:RebootInstances",
"ec2:RegisterTransitGatewayMulticastGroupMembers",
"ec2:RegisterTransitGatewayMulticastGroupSources",
"ec2:RejectTransitGatewayPeeringAttachment",
"ec2:RejectTransitGatewayVpcAttachment",
"ec2:RejectVpcEndpointConnections",
"ec2:RejectVpcPeeringConnection",
"ec2:ReplaceIamInstanceProfileAssociation",
"ec2:ReplaceRoute",
"ec2:ReplaceTransitGatewayRoute",
"ec2:RevokeClientVpnIngress",
"ec2:RevokeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress",
"ec2:RunInstances",
"ec2:SendDiagnosticInterrupt",
"ec2:StartInstances",
"ec2:StartVpcEndpointServicePrivateDnsVerification",
"ec2:StopInstances",
"ec2:TerminateClientVpnConnections",
"ec2:TerminateInstances",
"ec2:UpdateSecurityGroupRuleDescriptionsEgress",
"ec2:UpdateSecurityGroupRuleDescriptionsIngress",
"elasticloadbalancing:AddListenerCertificates",
"elasticloadbalancing:AddTags",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateRule",
"elasticloadbalancing:CreateTargetGroup",
"elasticloadbalancing:DeleteListener",
"elasticloadbalancing:DeleteLoadBalancer",
"elasticloadbalancing:DeleteRule",
"elasticloadbalancing:DeleteTargetGroup",
"elasticloadbalancing:DeregisterTargets",
"elasticloadbalancing:ModifyListener",
"elasticloadbalancing:ModifyLoadBalancerAttributes",
"elasticloadbalancing:ModifyRule",
"elasticloadbalancing:ModifyTargetGroup",
"elasticloadbalancing:ModifyTargetGroupAttributes",
"elasticloadbalancing:RegisterTargets",
"elasticloadbalancing:RemoveListenerCertificates",
"elasticloadbalancing:RemoveTags",
"elasticloadbalancing:SetIpAddressType",
"elasticloadbalancing:SetRulePriorities",
"elasticloadbalancing:SetSecurityGroups",
"elasticloadbalancing:SetSubnets",
"iam:CreateServiceLinkedRole"
]
Resource Exposure actions [link]
[
"ec2:CreateNetworkInterfacePermission",
"ec2:DeleteNetworkInterfacePermission",
"ec2:ModifySnapshotAttribute",
"ec2:ModifyVpcEndpointServicePermissions",
"ec2:ResetSnapshotAttribute",
"iam:CreateServiceLinkedRole"
]
Services: 4
Infrastructure Modification Actions: 84
{
"Statement": [
{
"Action": [
"rds:*",
"application-autoscaling:DeleteScalingPolicy",
"application-autoscaling:DeregisterScalableTarget",
"application-autoscaling:DescribeScalableTargets",
"application-autoscaling:DescribeScalingActivities",
"application-autoscaling:DescribeScalingPolicies",
"application-autoscaling:PutScalingPolicy",
"application-autoscaling:RegisterScalableTarget",
"cloudwatch:DescribeAlarms",
"cloudwatch:GetMetricStatistics",
"cloudwatch:PutMetricAlarm",
"cloudwatch:DeleteAlarms",
"ec2:DescribeAccountAttributes",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeInternetGateways",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"ec2:DescribeVpcAttribute",
"ec2:DescribeVpcs",
"sns:ListSubscriptions",
"sns:ListTopics",
"sns:Publish",
"logs:DescribeLogStreams",
"logs:GetLogEvents"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": "pi:*",
"Effect": "Allow",
"Resource": "arn:aws:pi:*:*:metrics/rds/*"
},
{
"Action": "iam:CreateServiceLinkedRole",
"Condition": {
"StringLike": {
"iam:AWSServiceName": [
"rds.amazonaws.com",
"rds.application-autoscaling.amazonaws.com"
]
}
},
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
}
- userwithlotsofpermissions
[
"cloudwatch:DeleteAlarms",
"cloudwatch:PutMetricAlarm",
"iam:CreateServiceLinkedRole",
"rds:AddRoleToDBCluster",
"rds:AddRoleToDBInstance",
"rds:AddSourceIdentifierToSubscription",
"rds:AddTagsToResource",
"rds:ApplyPendingMaintenanceAction",
"rds:AuthorizeDBSecurityGroupIngress",
"rds:BacktrackDBCluster",
"rds:CopyDBClusterParameterGroup",
"rds:CopyDBClusterSnapshot",
"rds:CopyDBParameterGroup",
"rds:CopyDBSnapshot",
"rds:CopyOptionGroup",
"rds:CreateDBCluster",
"rds:CreateDBClusterEndpoint",
"rds:CreateDBClusterParameterGroup",
"rds:CreateDBClusterSnapshot",
"rds:CreateDBInstance",
"rds:CreateDBInstanceReadReplica",
"rds:CreateDBParameterGroup",
"rds:CreateDBSecurityGroup",
"rds:CreateDBSnapshot",
"rds:CreateDBSubnetGroup",
"rds:CreateEventSubscription",
"rds:CreateGlobalCluster",
"rds:CreateOptionGroup",
"rds:DeleteDBCluster",
"rds:DeleteDBClusterEndpoint",
"rds:DeleteDBClusterParameterGroup",
"rds:DeleteDBClusterSnapshot",
"rds:DeleteDBInstance",
"rds:DeleteDBParameterGroup",
"rds:DeleteDBProxy",
"rds:DeleteDBSecurityGroup",
"rds:DeleteDBSnapshot",
"rds:DeleteDBSubnetGroup",
"rds:DeleteEventSubscription",
"rds:DeleteGlobalCluster",
"rds:DeleteOptionGroup",
"rds:DeregisterDBProxyTargets",
"rds:FailoverDBCluster",
"rds:ModifyCurrentDBClusterCapacity",
"rds:ModifyDBCluster",
"rds:ModifyDBClusterEndpoint",
"rds:ModifyDBClusterParameterGroup",
"rds:ModifyDBClusterSnapshotAttribute",
"rds:ModifyDBInstance",
"rds:ModifyDBParameterGroup",
"rds:ModifyDBProxy",
"rds:ModifyDBProxyTargetGroup",
"rds:ModifyDBSnapshot",
"rds:ModifyDBSnapshotAttribute",
"rds:ModifyDBSubnetGroup",
"rds:ModifyEventSubscription",
"rds:ModifyGlobalCluster",
"rds:ModifyOptionGroup",
"rds:PromoteReadReplica",
"rds:PromoteReadReplicaDBCluster",
"rds:PurchaseReservedDBInstancesOffering",
"rds:RebootDBInstance",
"rds:RegisterDBProxyTargets",
"rds:RemoveFromGlobalCluster",
"rds:RemoveRoleFromDBCluster",
"rds:RemoveRoleFromDBInstance",
"rds:RemoveSourceIdentifierFromSubscription",
"rds:RemoveTagsFromResource",
"rds:ResetDBClusterParameterGroup",
"rds:ResetDBParameterGroup",
"rds:RestoreDBClusterFromS3",
"rds:RestoreDBClusterFromSnapshot",
"rds:RestoreDBClusterToPointInTime",
"rds:RestoreDBInstanceFromDBSnapshot",
"rds:RestoreDBInstanceFromS3",
"rds:RestoreDBInstanceToPointInTime",
"rds:RevokeDBSecurityGroupIngress",
"rds:StartActivityStream",
"rds:StartDBCluster",
"rds:StartDBInstance",
"rds:StopActivityStream",
"rds:StopDBCluster",
"rds:StopDBInstance",
"sns:Publish"
]
Resource Exposure actions [link]
[
"rds:AuthorizeDBSecurityGroupIngress",
"iam:CreateServiceLinkedRole"
]
Services: 1
Infrastructure Modification Actions: 47
{
"Statement": [
{
"Action": "s3:*",
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
}
[
"s3:AbortMultipartUpload",
"s3:BypassGovernanceRetention",
"s3:CreateAccessPoint",
"s3:CreateBucket",
"s3:DeleteAccessPoint",
"s3:DeleteAccessPointPolicy",
"s3:DeleteBucket",
"s3:DeleteBucketPolicy",
"s3:DeleteBucketWebsite",
"s3:DeleteObject",
"s3:DeleteObjectTagging",
"s3:DeleteObjectVersion",
"s3:DeleteObjectVersionTagging",
"s3:GetObject",
"s3:ObjectOwnerOverrideToBucketOwner",
"s3:PutAccelerateConfiguration",
"s3:PutAccessPointPolicy",
"s3:PutAnalyticsConfiguration",
"s3:PutBucketAcl",
"s3:PutBucketCORS",
"s3:PutBucketLogging",
"s3:PutBucketNotification",
"s3:PutBucketObjectLockConfiguration",
"s3:PutBucketPolicy",
"s3:PutBucketPublicAccessBlock",
"s3:PutBucketRequestPayment",
"s3:PutBucketTagging",
"s3:PutBucketVersioning",
"s3:PutBucketWebsite",
"s3:PutEncryptionConfiguration",
"s3:PutInventoryConfiguration",
"s3:PutLifecycleConfiguration",
"s3:PutMetricsConfiguration",
"s3:PutObject",
"s3:PutObjectAcl",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionAcl",
"s3:PutObjectVersionTagging",
"s3:PutReplicationConfiguration",
"s3:ReplicateDelete",
"s3:ReplicateObject",
"s3:ReplicateTags",
"s3:RestoreObject",
"s3:UpdateJobPriority",
"s3:UpdateJobStatus"
]
Data Exfiltration actions [link]
[
"s3:GetObject"
]
Resource Exposure actions [link]
[
"s3:BypassGovernanceRetention",
"s3:DeleteAccessPointPolicy",
"s3:DeleteBucketPolicy",
"s3:ObjectOwnerOverrideToBucketOwner",
"s3:PutAccessPointPolicy",
"s3:PutAccountPublicAccessBlock",
"s3:PutBucketAcl",
"s3:PutBucketPolicy",
"s3:PutBucketPublicAccessBlock",
"s3:PutObjectAcl",
"s3:PutObjectVersionAcl"
]
Services: 1
Infrastructure Modification Actions: 1
{
"Statement": [
{
"Action": [
"s3:Get*",
"s3:List*"
],
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
}
- userwithlotsofpermissions
Data Exfiltration actions [link]
[
"s3:GetObject"
]
Services: 1
Infrastructure Modification Actions: 21
{
"Statement": [
{
"Action": [
"ses:*"
],
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
}
- userwithlotsofpermissions
[
"ses:CreateConfigurationSet",
"ses:CreateConfigurationSetEventDestination",
"ses:CreateDedicatedIpPool",
"ses:CreateDeliverabilityTestReport",
"ses:CreateEmailIdentity",
"ses:DeleteConfigurationSet",
"ses:DeleteConfigurationSetEventDestination",
"ses:DeleteDedicatedIpPool",
"ses:DeleteEmailIdentity",
"ses:PutConfigurationSetDeliveryOptions",
"ses:PutConfigurationSetReputationOptions",
"ses:PutConfigurationSetSendingOptions",
"ses:PutConfigurationSetTrackingOptions",
"ses:PutDedicatedIpInPool",
"ses:PutEmailIdentityDkimAttributes",
"ses:PutEmailIdentityFeedbackAttributes",
"ses:PutEmailIdentityMailFromAttributes",
"ses:SendEmail",
"ses:TagResource",
"ses:UntagResource",
"ses:UpdateConfigurationSetEventDestination"
]
Services: 3
Infrastructure Modification Actions: 38
{
"Statement": [
{
"Action": [
"autoscaling:Describe*",
"cloudwatch:*",
"logs:*",
"sns:*",
"iam:GetPolicy",
"iam:GetPolicyVersion",
"iam:GetRole"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": "iam:CreateServiceLinkedRole",
"Condition": {
"StringLike": {
"iam:AWSServiceName": "events.amazonaws.com"
}
},
"Effect": "Allow",
"Resource": "arn:aws:iam::*:role/aws-service-role/events.amazonaws.com/AWSServiceRoleForCloudWatchEvents*"
}
],
"Version": "2012-10-17"
}
- MyRole
- obama
- userwithlotsofpermissions
[
"cloudwatch:DeleteAlarms",
"cloudwatch:DeleteDashboards",
"cloudwatch:DeleteInsightRules",
"cloudwatch:DisableAlarmActions",
"cloudwatch:DisableInsightRules",
"cloudwatch:EnableAlarmActions",
"cloudwatch:EnableInsightRules",
"cloudwatch:PutDashboard",
"cloudwatch:PutInsightRule",
"cloudwatch:PutMetricAlarm",
"cloudwatch:SetAlarmState",
"cloudwatch:TagResource",
"cloudwatch:UntagResource",
"logs:AssociateKmsKey",
"logs:CreateExportTask",
"logs:CreateLogStream",
"logs:DeleteLogGroup",
"logs:DeleteLogStream",
"logs:DeleteMetricFilter",
"logs:DeleteRetentionPolicy",
"logs:DeleteSubscriptionFilter",
"logs:DisassociateKmsKey",
"logs:PutLogEvents",
"logs:PutMetricFilter",
"logs:PutRetentionPolicy",
"logs:PutSubscriptionFilter",
"logs:TagLogGroup",
"logs:UntagLogGroup",
"sns:AddPermission",
"sns:ConfirmSubscription",
"sns:CreateTopic",
"sns:DeleteTopic",
"sns:Publish",
"sns:RemovePermission",
"sns:SetTopicAttributes",
"sns:Subscribe",
"sns:TagResource",
"sns:UntagResource"
]
Resource Exposure actions [link]
[
"logs:DeleteResourcePolicy",
"logs:PutResourcePolicy",
"sns:AddPermission",
"sns:CreateTopic",
"sns:RemovePermission",
"sns:SetTopicAttributes"
]
Services: 1
Infrastructure Modification Actions: 78
{
"Statement": [
{
"Action": [
"iam:*",
"organizations:DescribeAccount",
"organizations:DescribeOrganization",
"organizations:DescribeOrganizationalUnit",
"organizations:DescribePolicy",
"organizations:ListChildren",
"organizations:ListParents",
"organizations:ListPoliciesForTarget",
"organizations:ListRoots",
"organizations:ListPolicies",
"organizations:ListTargetsForPolicy"
],
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
}
- userwithlotsofpermissions
[
"iam:AddClientIDToOpenIDConnectProvider",
"iam:AddRoleToInstanceProfile",
"iam:AddUserToGroup",
"iam:AttachGroupPolicy",
"iam:AttachRolePolicy",
"iam:AttachUserPolicy",
"iam:ChangePassword",
"iam:CreateAccessKey",
"iam:CreateGroup",
"iam:CreateInstanceProfile",
"iam:CreateLoginProfile",
"iam:CreateOpenIDConnectProvider",
"iam:CreatePolicy",
"iam:CreatePolicyVersion",
"iam:CreateRole",
"iam:CreateSAMLProvider",
"iam:CreateServiceLinkedRole",
"iam:CreateServiceSpecificCredential",
"iam:CreateUser",
"iam:CreateVirtualMFADevice",
"iam:DeactivateMFADevice",
"iam:DeleteAccessKey",
"iam:DeleteGroup",
"iam:DeleteGroupPolicy",
"iam:DeleteInstanceProfile",
"iam:DeleteLoginProfile",
"iam:DeleteOpenIDConnectProvider",
"iam:DeletePolicy",
"iam:DeletePolicyVersion",
"iam:DeleteRole",
"iam:DeleteRolePermissionsBoundary",
"iam:DeleteRolePolicy",
"iam:DeleteSAMLProvider",
"iam:DeleteSSHPublicKey",
"iam:DeleteServerCertificate",
"iam:DeleteServiceLinkedRole",
"iam:DeleteServiceSpecificCredential",
"iam:DeleteSigningCertificate",
"iam:DeleteUser",
"iam:DeleteUserPermissionsBoundary",
"iam:DeleteUserPolicy",
"iam:DeleteVirtualMFADevice",
"iam:DetachGroupPolicy",
"iam:DetachRolePolicy",
"iam:DetachUserPolicy",
"iam:EnableMFADevice",
"iam:PassRole",
"iam:PutGroupPolicy",
"iam:PutRolePermissionsBoundary",
"iam:PutRolePolicy",
"iam:PutUserPermissionsBoundary",
"iam:PutUserPolicy",
"iam:RemoveClientIDFromOpenIDConnectProvider",
"iam:RemoveRoleFromInstanceProfile",
"iam:RemoveUserFromGroup",
"iam:ResetServiceSpecificCredential",
"iam:ResyncMFADevice",
"iam:SetDefaultPolicyVersion",
"iam:TagRole",
"iam:TagUser",
"iam:UntagRole",
"iam:UntagUser",
"iam:UpdateAccessKey",
"iam:UpdateAssumeRolePolicy",
"iam:UpdateGroup",
"iam:UpdateLoginProfile",
"iam:UpdateOpenIDConnectProviderThumbprint",
"iam:UpdateRole",
"iam:UpdateRoleDescription",
"iam:UpdateSAMLProvider",
"iam:UpdateSSHPublicKey",
"iam:UpdateServerCertificate",
"iam:UpdateServiceSpecificCredential",
"iam:UpdateSigningCertificate",
"iam:UpdateUser",
"iam:UploadSSHPublicKey",
"iam:UploadServerCertificate",
"iam:UploadSigningCertificate"
]
Privilege Escalation methods
[link]
- Method: CreateAccessKey
Actions:
- iam:createaccesskey
- Method: CreateLoginProfile
Actions:
- iam:createloginprofile
- Method: UpdateLoginProfile
Actions:
- iam:updateloginprofile
- Method: CreateNewPolicyVersion
Actions:
- iam:createpolicyversion
- Method: SetExistingDefaultPolicyVersion
Actions:
- iam:setdefaultpolicyversion
- Method: AttachUserPolicy
Actions:
- iam:attachuserpolicy
- Method: AttachGroupPolicy
Actions:
- iam:attachgrouppolicy
- Method: PutUserPolicy
Actions:
- iam:putuserpolicy
- Method: PutGroupPolicy
Actions:
- iam:putgrouppolicy
- Method: AddUserToGroup
Actions:
- iam:addusertogroup
Resource Exposure actions [link]
[
"iam:AddClientIDToOpenIDConnectProvider",
"iam:AddRoleToInstanceProfile",
"iam:AddUserToGroup",
"iam:AttachGroupPolicy",
"iam:AttachRolePolicy",
"iam:AttachUserPolicy",
"iam:ChangePassword",
"iam:CreateAccessKey",
"iam:CreateAccountAlias",
"iam:CreateGroup",
"iam:CreateInstanceProfile",
"iam:CreateLoginProfile",
"iam:CreateOpenIDConnectProvider",
"iam:CreatePolicy",
"iam:CreatePolicyVersion",
"iam:CreateRole",
"iam:CreateSAMLProvider",
"iam:CreateServiceLinkedRole",
"iam:CreateServiceSpecificCredential",
"iam:CreateUser",
"iam:CreateVirtualMFADevice",
"iam:DeactivateMFADevice",
"iam:DeleteAccessKey",
"iam:DeleteAccountAlias",
"iam:DeleteAccountPasswordPolicy",
"iam:DeleteGroup",
"iam:DeleteGroupPolicy",
"iam:DeleteInstanceProfile",
"iam:DeleteLoginProfile",
"iam:DeleteOpenIDConnectProvider",
"iam:DeletePolicy",
"iam:DeletePolicyVersion",
"iam:DeleteRole",
"iam:DeleteRolePermissionsBoundary",
"iam:DeleteRolePolicy",
"iam:DeleteSAMLProvider",
"iam:DeleteSSHPublicKey",
"iam:DeleteServerCertificate",
"iam:DeleteServiceLinkedRole",
"iam:DeleteServiceSpecificCredential",
"iam:DeleteSigningCertificate",
"iam:DeleteUser",
"iam:DeleteUserPermissionsBoundary",
"iam:DeleteUserPolicy",
"iam:DeleteVirtualMFADevice",
"iam:DetachGroupPolicy",
"iam:DetachRolePolicy",
"iam:DetachUserPolicy",
"iam:EnableMFADevice",
"iam:PassRole",
"iam:PutGroupPolicy",
"iam:PutRolePermissionsBoundary",
"iam:PutRolePolicy",
"iam:PutUserPermissionsBoundary",
"iam:PutUserPolicy",
"iam:RemoveClientIDFromOpenIDConnectProvider",
"iam:RemoveRoleFromInstanceProfile",
"iam:RemoveUserFromGroup",
"iam:ResetServiceSpecificCredential",
"iam:ResyncMFADevice",
"iam:SetDefaultPolicyVersion",
"iam:SetSecurityTokenServicePreferences",
"iam:UpdateAccessKey",
"iam:UpdateAccountPasswordPolicy",
"iam:UpdateAssumeRolePolicy",
"iam:UpdateGroup",
"iam:UpdateLoginProfile",
"iam:UpdateOpenIDConnectProviderThumbprint",
"iam:UpdateRole",
"iam:UpdateRoleDescription",
"iam:UpdateSAMLProvider",
"iam:UpdateSSHPublicKey",
"iam:UpdateServerCertificate",
"iam:UpdateServiceSpecificCredential",
"iam:UpdateSigningCertificate",
"iam:UpdateUser",
"iam:UploadSSHPublicKey",
"iam:UploadServerCertificate",
"iam:UploadSigningCertificate"
]
Guidance
Triaging
Understanding Context
It's essential to understand the context behind the findings that the report generates. Understanding the context behind the findings aids the assessor in triaging the results accurately.
This report generates findings on Policies that do not leverage resource constraints and identifies some attributes to help prioritize which ones to address - such as Privilege Escalation, Resource Exposure, and Data Exfiltration. These results help you to identify your IAM threat landscape and reduce blast radius. In the event of credential compromise, you can prevent an attacker from exploiting the risks mentioned above, in addition to preventing mass deletion, destruction, or modification of existing infrastructure.
However, this tool does not attempt to understand the context behind everything in your AWS account. It's possible to understand the context behind some of these things programmatically - whether the policy is applied to an instance profile, whether the policy is attached, whether inline IAM policies are in use, and whether or not AWS Managed Policies are in use. Only you know the context behind the design of your AWS infrastructure and the IAM strategy.
For example, an AWS Lambda policy used as a simple service checking the configuration of AWS infrastructure might be a good use case for resource constraints. Conversely, perhaps you applied the AdministratorAccess AWS-managed policy to an Instance Profile so that an EC2 instance can run Terraform to provision AWS resources via Infrastructure as Code. In the second example, the role is extremely permissive by design - and a tool can't automatically understand that context.
As such, the tool aims to:
- Map out your risk landscape of IAM identity-based policies, enumerating the potential risks for a full IAM threat model
- Identify where you can reduce the blast radius in the case of credentials compromise
- Help you prioritize which ones to remediate
- Provide a straightforward workflow to remediate
- Provide a sufficient exclusions mechanism to programmatically define where deviations from resource constraints are by design
Assessment Recap
To recap: you've followed these steps to generate this report:
- Downloaded the Account Authorization details JSON file
cloudsplaining download --profile default --output default-account-details.json
- Generated your custom exclusions file
cloudsplaining create-exclusions-file --output-file exclusions.yml
- Generated the report
cloudsplaining scan --input default-account-details.json --exclusions-file exclusions.yml
- This generates three files: (1) The single-file HTML report, (2) The triage CSV worksheet, and (3) The raw JSON data file
Triaging workflow
An assessor can follow this general workflow:
- Open a ticket in your organization's project management tool of choice (for example, JIRA or Salesforce) in the AWS account owner's project
- Attach the HTML report, JSON Data file, and CSV worksheet
- Ask the service/account owner team to fill out the Triage worksheet
When you ask the service/account owner team to fill out the Triage CSV worksheet, you can use some text like the following:
As part of our security assessment, our team ran Cloudsplaining on your AWS account. Cloudsplaining maps out the IAM risk landscape in a report, identifies where resource ARN constraints are not in use, and identifies other risks in IAM policies like Privilege Escalation, Data Exfiltration, and Resource Exposure/Permissions management. Remediating these issues, where applicable, will help to limit the blast radius in the case of compromised AWS credentials.
We request that you review the HTML report and fill out the "Justification" field in the Triage worksheet. Based on the corresponding details in the HTML report, provide either (1) A justification on why the result is a False Positive, or (2) Identify that it is a legitimate finding.
Triaging considerations
When triaging your results, consider some of the factors listed below as you identify False Positives vs. legitimate findings. There are some scenarios where "Resource": "*"
access is by design and is therefore a false positive. This section covers some of the common scenarios.
Infrastructure Creation roles:
IAM roles that create infrastructure via Infrastructure as Code Technologies (for example, Terraform or CloudFormation) require high permission levels to provision AWS infrastructure. These will usually be false positives. When you see these instances, make sure that these roles are adequately protected. For instance, make sure that roles within the AWS account are not able to assume this role or affect its configuration in any way. Additionally, consider restricting the trust policy so that a set of explicitly stated IAM principals are the only ones who can assume that role. Take special care to audit instances of sts:AssumeRole
within this AWS account.
System roles vs. User Roles: System roles - IAM Roles applied to compute services, such as EC2 Instance Profiles, ECS Task Execution roles, or Lambda Task Execution roles - should almost always leverage resource ARN constraints for actions that perform "Write" actions. Exceptions to this could include Infrastructure provisioning or other edge cases.
Conversely, user roles will almost always be used against *
resources for the sake of convenience, innovation, and avoiding overly restrictive limitations. In the user role scenario, consider:
- Design context: is it appropriate? (For instance, maybe all your user roles don't need
iam:*
)
- Environment: If this is a Dev environment, frequently-used user roles probably allow more permissions for innovation purposes. However, in later environments - especially production - commonly used user roles should be read-only - or the more permissive ones should be for break-glass scenarios only.
- Regardless of the context: there should always be security guardrails in place, like Service Control Policies through AWS Organizations or IAM Permissions Boundaries to prevent against egregious mistakes.
Organization-specific results
For example, perhaps you allow kms:Decrypt for * resources (by design) in your organization for one reason or another. Cloudsplaining flags this as a result. However, there are mitigating controls in place. Firstly, you leverage strict resource-based KMS key policies to lock down all KMS keys, explicitly stating individual IAM principals that are allowed to use them. Secondly, you provision all KMS keys with CloudFormation or Terraform, so you are confident that this pattern is consistent across all KMS keys in your AWS accounts. Therefore, kms:Decrypt
to *
resources is not a finding you are concerned about. In this case, you decide it is acceptable to exclude kms:Decrypt
from your results.
Common False Positive Scenarios
Conditions Logic:
This tool does not evaluate IAM Conditions logic. If your policies use wildcard resources but restrict according to condition keys, then it's possible this is a false positive. However, you might want to double-check the accuracy of the conditions logic in those IAM policies. While IAM conditions can be extremely powerful, implementation is also prone to human error. We suggest leveraging Parliament by Duo Labs (courtesy of Scott Piper), to lint your policies for accuracy - especially when IAM conditions are in use.
logs:CreateLogGroup
and logs:PutLogEvent
:
Depending on how your organization approaches CloudWatch Logs Agent configuration, IAM, and CloudWatch Logs Group naming conventions, it is sometimes near-impossible to prevent cross-contamination of logs or Log Injection to the Log Streams from other instance IDs. Cross-Contamination of CloudWatch Logs is an issue of its own that is definitely beyond the scope of this document - but consider this as a potential limitation by AWS when trying to identify a remediation plan.
Building the Exclusions File
After you have identified the False Positives, add the False Positive criteria to your custom Cloudsplaining exclusions file. The False Positives generally fall into one of two categories:
- False positives that will occur across all of your AWS accounts, due to your organization-wide implementation strategy
- False positives specific to this AWS account
To make the exclusions file, create a YAML file that we will use to list out exclusions with the create-exclusions-file
command.
cloudsplaining create-exclusions-file
This will generate a file titled exclusions.yml
in your current directory.
The default exclusions file contains these contents:
# Policy names to exclude from evaluation
# Suggestion: Add policies here that are known to be overly permissive by design, after you run the initial report.
policies:
- "AWSServiceRoleFor*"
- "*ServiceRolePolicy"
- "*ServiceLinkedRolePolicy"
- "AdministratorAccess" # Otherwise, this will take a long time
- "service-role*"
- "aws-service-role*"
# Don't evaluate these roles, users, or groups as part of the evaluation
roles:
- "service-role*"
- "aws-service-role*"
users:
- ""
groups:
- ""
# Read-only actions to include in the results, such as s3:GetObject
# By default, it includes Actions that could lead to Data Exfiltration
include-actions:
- "s3:GetObject"
- "ssm:GetParameter"
- "ssm:GetParameters"
- "ssm:GetParametersByPath"
- "secretsmanager:GetSecretValue"
# Write actions to include from the results, such as kms:Decrypt
exclude-actions:
- ""
Add whatever values you want to the above depending on your organization's context.
* Under policies
, list the path of policy names that you want to exclude.
* If you want to exclude a role titled MyRole
, list MyRole
or MyR*
in the roles
list.
* You can follow the same approach for users
and groups
list.
- Now, run the scan to generate a new Cloudsplaining report that considers your exclusions criteria. This way, you are working with a report version that consists of True Positives only.
cloudsplaining scan --input default.json --exclusions-file exclusions.yml
You can now proceed to the Remediation stage.
Prioritizing Remediation
Depending on the existing workload of the engineering team addressing your concerns, the team might ask to address high priority items first rather than addressing all items, especially if the report is quite large. In this scenario, consider instructing the team to address High Priority Risks and the usage of AWS-Managed Policies first.
High priority risks:
These include Privilege Escalation, Data Exfiltration, and Potential Resource Exposure/Permissions management. This report highlights each finding that has these high priority risks.
Moving from AWS Managed Policies over to custom policies:
AWS managed policies always include access to *
resources because AWS provides these same policies universally to all customer accounts. If this report flags any AWS-managed policies, it means that the account/service owner team will not only have to implement resource constraints - they will have to create a custom IAM policy to do so. To limit this work, it is best to migrate away from the root cause of the problem - using AWS managed policies.
You can then queue the work for remediating the other Customer-managed policies that do not have the High-Priority Risks attributes. Implementing resource ARN constraints for True Positives is still important, since overly permissive "Write" actions can cause modification or deletion of AWS resources by a bad actor with compromised credentials, resulting in downtime.
Remediating the Findings
We suggest two options for remediating each finding:
Leveraging Policy Sentry
For guidance on how to use Policy Sentry, please see the documentation here. This is highly suggested - within 10 minutes of learning the tool, creating a secure IAM policy becomes a matter of:
Manually rewriting the IAM Policies
For guidance on how to write secure IAM Policies by hand, see the tutorial here. Just be aware - you'll spend a lot of time looking at the AWS Documentation on IAM Actions, Resources, and Condition Keys, which can become quite tedious and time-consuming.
Validation
Validating remediated policies
After you've rewritten your IAM policy, we suggest two options for validating that it will pass Cloudsplaining and alleviate any remaining concerns:
- Run Cloudsplaining's
scan-policy-file
command, which scans a single JSON policy file instead of the entire AWS Account's Authorization details.
- Leveraging Parliament by Duo-Labs, courtesy of Scott Piper
Using Cloudsplaining to Validate your Remediated Policies
You can validate that your remediated policy passes Cloudsplaining by running the following command:
cloudsplaining scan-policy-file --input policy.json --exclusions-file exclusions.yml
When there are no more results, it passes!
Using Parliament to Lint your Policies
parliament is an AWS IAM linting library. It reviews policies looking for problems such as:
- malformed JSON
- missing required elements
- incorrect service prefix and action names
- incorrect resources or conditions for the actions provided
- type mismatches
- bad policy patterns
This library duplicates (and adds to!) much of the functionality in the web console page when reviewing IAM policies in the browser.
You can use Parliament to scan your IAM policy with the following command:
parliament --file policy.json
Appendix
Glossary
Impact
The impact the risk would have on an organization if such a vulnerability were successfully exploited is rated according to criteria listed below. Note that these ratings are based on NIST 800-30 impact definitions.
- Critical: The issue causes multiple severe or catastrophic effects on operations, assets or other organizations.
- High: Causes produces severe degradation in mission capability to the point that the organization is not able to perform primary functions or results in damage to organizational assets.
- Medium: Trigger degradation in mission capability to an extent the application is able to perform its primary functions, but their effectiveness is reduced and there may be damage to the organization's assets.
- Low: Results in limited degradation in mission capability; the organization is able to perform its primary functions, but their effectiveness is noticeably reduced and may result in minor damage to the organization's assets.
Privilege Escalation
These policies allow a combination of IAM actions that allow a principal with these permissions to escalate their privileges - for example, by creating an access key for another IAM user, or modifying their own permissions. This research was pioneered by Spencer Gietzen at Rhino Security Labs. Remediation Guidance can be found here.
Resource Exposure
Resource Exposure actions allow modification of Permissions to resource-based policies or otherwise can expose AWS resources to the public via similar actions that can lead to resource exposure - for example, the ability to modify AWS Resource Access Manager.
Infrastructure Modification
Infrastructure Modification describes IAM actions with "modify" capabilities, and can therefore lead to Resource Hijacking, unauthorized creation of Infrastructure, Backdoor creation, and/or modification of existing resources which can result in downtime.
Data Exfiltration
Policies with Data leak potential allow certain read-only IAM actions without resource constraints, such as s3:GetObject
, ssm:GetParameter*
, or secretsmanager:GetSecretValue
. Unrestricted s3:GetObject
permissions has a long history of customer data leaks. ssm:GetParameter*
and secretsmanager:GetSecretValue
are both used to access secrets. rds:CopyDBSnapshot
and rds:CreateDBSnapshot
can be used to exfiltrate RDS database contents.
Roles Assumable by Compute Services
IAM Roles can be assumed by AWS Compute Services (such as EC2, ECS, EKS, or Lambda) can present greater risk than user-defined roles, especially if the AWS Compute service is on an instance that is directly or indirectly exposed to the internet. Flagging these roles is particularly useful to penetration testers (or attackers) under certain scenarios. For example, if an attacker obtains privileges to execute ssm:SendCommand and there are privileged EC2 instances with the SSM agent installed, they can effectively have the privileges of those EC2 instances. Remote Code Execution via AWS Systems Manager Agent was already a known escalation/exploitation path, but Cloudsplaining can make the process of identifying theses cases easier.
Trust Policy
A JSON policy document in which you define the principals that you trust to assume the role. A role trust policy is a required resource-based policy that is attached to a role in IAM. The principals that you can specify in the trust policy include users, roles, accounts, and services.
This definition was taken from the AWS Documentation here.
Principal
An entity in AWS that can perform actions and access resources. A principal can be an AWS account root user, an IAM user, or a role.
Role
An IAM identity that you can create in your account that has specific permissions. An IAM role has some similarities to an IAM user. Roles and users are both AWS identities with permissions policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it. Also, a role does not have standard long-term credentials such as a password or access keys associated with it. Instead, when you assume a role, it provides you with temporary security credentials for your role session.
We are particularly interested in roles used for compute services - i.e., Compute Service Roles.
This definition was taken from the AWS Documentation here.
Managed Policy
There are two types of Managed Policies: AWS-managed policies and Customer-managed policies. They are described below.
Criteria for selecting Managed Policies versus Inline policies can be found in the AWS documentation here.
Customer-managed policy
AWS documentation on Customer-managed policies can be found here.
The following diagram illustrates customer managed policies. Each policy is an entity in IAM with its own Amazon Resource Name (ARN) that includes the policy name. Notice that the same policy can be attached to multiple principal entities—for example, the same DynamoDB-books-app policy is attached to two different IAM roles.
AWS-managed policy
An AWS managed policy is a standalone policy that is created and administered by AWS. Standalone policy means that the policy has its own Amazon Resource Name (ARN) that includes the policy name. For example, arn:aws:iam::aws:policy/IAMReadOnlyAccess is an AWS managed policy.
AWS documentation on AWS-managed policies can be found here.
The following diagram (taken from the AWS documentation) illustrates AWS managed policies. The diagram shows three AWS managed policies: AdministratorAccess, PowerUserAccess, and AWSCloudTrailReadOnlyAccess. Notice that a single AWS managed policy can be attached to principal entities in different AWS accounts, and to different principal entities in a single AWS account.
Inline Policy
An inline policy is a policy that's embedded in an IAM identity (a user, group, or role). That is, the policy is an inherent part of the identity. You can create a policy and embed it in a identity, either when you create the identity or later.
AWS documentation on inline policies can be found here.
The following diagram illustrates inline policies. Each policy is an inherent part of the user, group, or role. Notice that two roles include the same policy (the DynamoDB-books-app policy), but they are not sharing a single policy; each role has its own copy of the policy.
Inline policies are useful if you want to maintain a strict one-to-one relationship between a policy and the identity that it's applied to. For example, you want to be sure that the permissions in a policy are not inadvertently assigned to an identity other than the one they're intended for. When you use an inline policy, the permissions in the policy cannot be inadvertently attached to the wrong identity. In addition, when you use the AWS Management Console to delete that identity, the policies embedded in the identity are deleted as well. That's because they are part of the principal entity.
Exclusions configuration
The Cloudsplaining exclusions configuration is shown below. You can leverage this to ensure reusability, for next time you run the scan.
exclude-actions:
- ''
groups:
- ''
include-actions:
- s3:GetObject
- ssm:GetParameter
- ssm:GetParameters
- ssm:GetParametersByPath
- secretsmanager:GetSecretValue
- rds:CopyDBSnapshot
- rds:CreateDBSnapshot
policies:
- AWSServiceRoleFor*
- '*ServiceRolePolicy'
- '*ServiceLinkedRolePolicy'
- AdministratorAccess
- service-role*
- aws-service-role*
- MyRole
roles:
- service-role*
- aws-service-role*
users:
- ''
References


[gecode-users] Float values and element constraint
Dani G
daniel.garcialorenzo at gmail.com
Tue Feb 21 19:45:12 CET 2017
Hello Arshad,
You should check the mail archives. I just posted a similar question few
months ago and here is the answer:
http://www.gecode.org/pipermail/users/2016-November/004911.html
In any case, I would really try to convert your float variables into a
Integer one. For example, in a similar problem I used cents (integer)
instead of dollars (float), just by multiplying by 100 my input values...
In any case, I find float variables more complicated to use.
Regards
Daniel
2017-02-21 13:59 GMT+01:00 Arshad Khan <khan.m.arshad at gmail.com>:
> Hello All,
>
> I am a Gecode novice and seeking your expert help on one of the issue that
> I am facing when using float values.
>
> In the example warehouse.cpp, the supply cost from a warehouse to a store
> is defined using an int value matrix (c_supply). This matrix is later
> used in one of the constraint that computes the cost. Now I want to use a
> cost matrix of float values. However, the constraint uses an 'element'
> constraint to compute the cost which is not defined for float values. How
> can I convert the constraint to use float values? Any help is greatly
> appreciated.
>
> For your reference, the relevant code from the example is follows:
>
> // Compute cost for each warehouse
> for (int s=0; s<n_stores; s++) {
> IntArgs c(n_warehouses, c_supply[s]);
> c_store[s] = expr(*this, element(c, supplier[s]));
> }
>
> (What I want is to have a FloatValArgs type for c.)
>
> Thanks and Regards
> Arshad
>
> _______________________________________________
> Gecode users mailing list
> users at gecode.org
> https://www.gecode.org/mailman/listinfo/gecode-users
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.gecode.org/pipermail/users/attachments/20170221/86fdf7c9/attachment.html>
More information about the users
mailing list


Ergonomic and complete, Geotrek allows management and fine development of the area through rich and innovative features
Geotrek-Admin for data management, Geotrek‑Rando for the promotion of activities and Geotrek-Mobile in the field are an unique and compelling offering
Publish under free BSD license, Geotrek is evolving thanks to its users community which benefits from investment and contribute to the benefits of all
{% include date.html date=post.date %}{{ month }} {{ year }}
{{ post.content }}


__call()
__construct()
__toString()
collect()
compareObjects()
count()
current()
deleteAll()
filterBy()
first()
getObjectsClassName()
getPage()
getPageCount()
getRawArray()
key()
next()
offsetExists()
offsetGet()
offsetSet()
offsetUnset()
orderBy()
removeFilter()
removeFilters()
rewind()
valid()
filterObject()
$class_name
$object_keys
$objects
$operators
$previous_result_set
COLLECT_PREFIX
FILTER_PREFIX
ORDER_PREFIX
List of objects on steroids.
Class used for wrapping list of objects into result set with filtering, ordering and paging capabilities.
| author | Tomasz Sawicki (https://github.com/Furgas) |
|---|---|
| package | Common |
__call(string $name, array $arguments) : \kyResultSet
To get available filter methods, call kyObjectType::getAvailableFilterMethods(). To get available order methods, call kyObjectType::getAvailableOrderMethods().
string
Method name.
array
Method arguments.
__construct(\kyObjectBase[] | \kyResultSet $objects, string $class_name, \kyResultSet $previous_result_set)
string
Optional. Class name of objects in this result set.
\kyResultSet
Optional result set which was the base of filtering operation producing this result set.
__toString()
Calls __toString method of every object.
collect(string $get_method_name) : array
NOTICE: This method shouldn't be used directly in most cases. Use kyResultSet->collectXXX() instead.
Additional method arguments will be passed as arguments to the get method.
string
Name of the method to call on object.
array
compareObjects(\kyObjectBase $object1, \kyObjectBase $object2, string $get_method_name, bool $asc) : int
NOTICE: Internal helper method for sorting.
string
Name of get method to call on each object to compare its values.
bool
True (default) to sort ascending. False to sort descending.
int
count()
current()
deleteAll()
WARNING: Use carefully!
filterBy(string $get_method_name, array $filter_values) : \kyResultSet
Filtering is done by calling defined get method on all objects and comparing its result with provided filter values. Filter value can be any scalar value (integer, float, string or boolean) or array for special cases. Special cases for filter value: - array('~' "Perl regexp pattern") - running Perl regexp match against object value - array('>', filter_value) - values greater than provided = array('<', filter_value) - values lesser than provided - array('>=', filter_value) - values greater or equal than provided - array('<=', filter_value) - values lesser or equal than provided - array('!=', filter_value) - values other than provided
NOTICE: This method shouldn't be used directly in most cases. Use kyResultSet->filterByXXX(filter_value1, filter_value2) instead. Call kyObjectType::getAvailableFilterMethods() for possible filter methods.
Additional method arguments will be passed as arguments to the get method.
string
Name of get method to call on every object for comparing its value with filter values.
array
List of filter values.
getObjectsClassName() : string
string
getPage(int $page_number, int $items_per_page) : \kyResultSet
Pass page number and maximum items count per page and it will return new result with items on specified page.
NOTICE: Use the same maximum number of items per page for each page to get the proper behaviour.
int
Page number, starting from 1.
int
Maximum number of items per page (default 20).
getPageCount(int $items_per_page) : int
int
Maximum number of items per page (default 20).
int
key()
next()
offsetExists($offset)
offsetGet($offset)
offsetSet($offset, $value)
offsetUnset($offset)
orderBy(string $get_method_name, bool $asc) : \kyResultSet
Sorting is done by calling defined get method on all objects and using its result to sort objects. NOTICE: This method shouldn't be used directly in most cases. Use kyResultSet->orderByXXX() instead. Call kyObjectType::getAvailableOrderMethods() for possible order methods. WARNING: Calling this method resets internal pointer of objects array.
string
Name of get method to call on every object to order based on its value.
bool
True (default) to sort ascending. False to sort descending.
rewind()
valid()
filterObject(array $filter_values, array $object_values) : bool
array
Filter values.
array
Object values.
bool
$class_name : string
$object_keys : mixed[]
$operators : string[]
$previous_result_set : \kyResultSet
COLLECT_PREFIX : string
FILTER_PREFIX : string
ORDER_PREFIX : string


Equivalent to clicking the Merge button in the Style dialog box, which appears when you click the Style command on the Format menu. Merges all the styles from another workbook into the active workbook. Use MERGE.STYLES when you want to import styles from another sheet in another workbook.
Syntax
MERGE.STYLES(document_text)
Document_text is the name of a sheet in a workbook from which you want to merge styles into the active workbook.
Remarks
If any styles from the workbook being merged have the same name as styles in the active workbook, a dialog box appears asking if you want to replace the existing definitions of the styles with the "merged" definitions of the styles. If you click the Yes button, all the definitions are replaced; if you click the No button, all the original definitions in the active workbook are retained.
When you move a sheet with styles to another workbook with styles, any styles with identical names but conflicting definitions have the sheet name added to the style name.
Related Functions
DEFINE.STYLE Creates or changes a cell style
DELETE.STYLE Deletes a cell style
Return to index


'Did people start dying today?' – Hawa Koomson on distribution of ambulances
Notwithstanding pressure from the Minority in Parliament and civil society, especially pressure group, OccupyGhana for some ambulances procured by government to be distributed immediately across the country to save lives, the Minister for Special Development Initiative, under whose purview the distribution lies is adamant that it will be done next year.
To Mavis Hawa Koomson, the assertion that failure to deliver the ambulances to the constituencies could increase the deaths of unfortunate Ghanaians, is neither here nor there, since “people started dying a long time ago.”
She was speaking in an interview with Neat FM.
55 Ambulances for 29 million Ghanaians
The state of Ghana’s ambulance service has been described by many in the health sector as critical. A country of about 29 million people only has 55 functioning ambulances serving all 10 regions.
Ghana currently has 155 ambulances, 100 of which have broken down due to various faults, many of them engine-related.
The National Headquarters of the Ambulance Service in Accra has only four ambulances.
Lack Of Ambulances Causing Daily Deaths - Minority
It is for this reason that perhaps the Minority held a press conference last week, asking for the immediate distribution of some 48 ambulances parked at the forecourt of Parliament.
96 out of the 275 ambulances purchased under Government's One Constituency One Ambulance initiative are currently parked at the State House awaiting distribution.
The group alleged that a countless number of people are dying as a result of the lack of emergency health-care delivery systems.
"The decision to install trackers and other equipment into those ambulances do not hold . . . Ghanaians are dying on a daily basis due to the lack of ambulances across the country why should we keep them to rot when they need it to work.
" . . We have written to the government to instruct the sector Minister to distribute the ambulances," the Minority said.
We Won't Be Spectators To Parked Ambulances
Pressure group, OccupyGhana, also waded in the fray wondering why the ambulances were left idling in the wake of concerns over a shortage in the number of working ambulances in the country.
"It is enshrined in the Constitution, Article 34(2) that the citizenry has a Right to Good Health Care. How does parking the buses in front of the State House ensure that?
"We rallied behind the President to his clarion call to be citizens. We will not settle to be spectators, especially to parked ambulances. Accordingly, we demand answers and no excuse but prompt and immediate action," the pressure group said in a statement issued over the weekend.
But the Minister for Special Development Initiative appears unmoved by these remarks, saying her outfit will ensure that what needs to be done first is done before the ambulances are distributed.


by Ed Fraser, Military Postal History Society
This article was created by Ed Fraser of the Military Postal History Society, and his sole property. The article describes the discovery of a new undercover address used in Lisbon, Portugal during the Second World War. Illustrations of postal history items provide insight into this subject. This article is offered to the general public and members of the MPHS for educational purposes.
This story was first reported in the Autumn 2017 "Belgapost" quarterly of the Belgian Philatelic Study Circle in the U.K. As perhaps an instructive example of how after 75 years such an address can be identified in today's partly-digitized world, and in hopes further information may be uncovered, here is a re-telling of it.
The two covers, front and back, shown in Figures 1 and 2 , are an interesting study in several ways. As examples of mail from German occupied Belgium to neutral Portugal, both have the routine Munich office censor tape, indicated by the "d" on the tape. That was the German censor office that mail to Portugal was typically censored at. However, on top of German censor tape or markings, and the Lisbon arrival cancel, is a British P.C. 90 censor tape. Those tapes have censor numbers on them believed to have been in the U.K.
Front of Cover #1
Front of Cover #2
Two covers from Belgium to the same addressee, with German censorship, and British censorship after reaching Lisbon. Top cover stamps' date and place covered by German censor tape, but backstamped Antwerpen (the German for Antwerp) 21 Dec 1943 and Lisbon 6 Jan 1944. Bottom cover stamp canceled Antwerpen but date seems unclear – possibly 1 Feb 1944 (?), but backstamped (in Belgium?) 31 Jan 1944 and Lisbon 19 Feb 1944.
Back of Cover #1
Back of Cover #2
The backs of the 2 covers in Figure 1 . No sender or return address indicated.
Might this have been some private arrangement with a friend in Portugal to forward correspondence between Belgium and the U.K.? The clues to that are pretty good. There is no listing for the address 34 Rua Ernesto da Silva in a Lisbon suburb in the reference "Undercover Addresses of WWII – Third Edition" by Charles Entwistle, and he confirmed that in a recent e-mail. There is nothing unusual about the building currently at that address which appears to possibly be the home and location of a plumbing and electrical service person, without any signage in Google map/street photos.
And then there is a bit of "education" in European penmanship here. What is the addressee's name? First noting between the 2 covers, apparently by the same hand, the "L" in Lisbon. It is very suggestive of a name Gabriel "Leydel". The "a" and "d" in "da Silva" of the address explain the "odd looking" letter "d" in "Leydel" – not the penmanship strokes used in the U.S, but consistent and neat in any case...and a European style sometimes seen elsewhere. However, while a common enough name in a Google search, but not with clear Belgian ties, that went nowhere. Trying again, and looking at the strokes of that "L" of "Lisbon" seemed quite convincing that it was not exactly a match to the name, but rather to the "S" in the street name "da Silva". The amazing result was, via Google, the Belgian ties of one quite noteworthy WWII RAF pilot, one Gabriel "Seydel".
One thing I liked about these two covers was that the name was underlined – for example in red, and also in red was an added number "349", and the "349" was on both covers. This had suggested to me a strong possibility of the forwarder in Portugal working off a card file or notebook of addresses for mail forwarding, and this addressee was number "349". Recently I had written an article for the Scandinavian Collectors Club "Posthorn" magazine (May 2016, cover and pages 13-19) about such a card file used by the Norwegian Embassy in Lisbon for mail routing between Occupied Norway and many escaped Norwegians especially one's tied to the Government in Exile – and the Embassy person who oversaw this effort frequently used various residential addresses in hopes of not attracting German censorship attention. Maybe the Belgians did something similar? That was the thought.
Anyway, back to our addressee Gabriel Seydel. The first result was 100% in French, and with a lot of military abbreviations that meant nothing to me. It was clear there might be a link, though. Refining that search now produced a fascinating biography, and even a photo! That information is shown below . And the key item -- the greatest key assuming it was put on the cover at the time of its original handling -- is that number 349, and being on both covers! That turns out to apparently have been used to direct the addressee's mail to his RAF Squadron of Belgian Volunteers, Squadron 349! As an aside, our addressee bounced between Squadron 350 and 349 during the war years, but the mail sorter here had it right for the time of these letter mailings.
Biography of Gabriel Seydel
Above, a biographical piece about Gabriel Seydel from the website http://www.350sqn.be/biography/Seydel%20Gabriel.htm The website is dedicated to information about RAF Squadron 350 and those who served in it at any time during the war -- which he did for a time.
So, as a likely hypothesis, it would seem there is a good case for this address in Lisbon being one for mail handling between Belgian RAF military and Belgium -- or perhaps elsewhere in Occupied Europe as well.
Any further information or detail greatly appreciated. My collecting focus is on undercover mail, including that involving the Thomas Cook & Son wartime civilian undercover mail scheme.
<EMAIL_ADDRESS>Belgian Philatelic Study Circle (background)
German Occupation (background)


Canvas QML Type
Provides a 2D canvas item enabling drawing via JavaScript More...
| Import Statement: | import QtQuick 2.7 |
| Since: | Qt 5.0 |
| Inherits: |
Properties
- available : bool
- canvasSize : size
- context : object
- contextType : string
- renderStrategy : enumeration
- renderTarget : enumeration
Signals
- imageLoaded()
- paint(rect region)
- painted()
Methods
- cancelRequestAnimationFrame(int handle)
- object getContext(string contextId, ... args)
- isImageError(url image)
- isImageLoaded(url image)
- isImageLoading(url image)
- loadImage(url image)
- markDirty(rect area)
- int requestAnimationFrame(callback)
- requestPaint()
- bool save(string filename)
- string toDataURL(string mimeType)
- unloadImage(url image)
Detailed Description
The Canvas item allows drawing of straight and curved lines, simple and complex shapes, graphs, and referenced graphic images. It can also add text, colors, shadows, gradients, and patterns, and do low level pixel operations. The Canvas output may be saved as an image file or serialized to a URL.
Rendering to the Canvas is done using a Context2D object, usually as a result of the paint signal.
To define a drawing area in the Canvas item set the width
and height
properties. For example, the following code creates a Canvas item which has a drawing area with a height of 100 pixels and width of 200 pixels:
import QtQuick 2.0 Canvas { id: mycanvas width: 100 height: 200 onPaint: { var ctx = getContext("2d"); ctx.fillStyle = Qt.rgba(1, 0, 0, 1); ctx.fillRect(0, 0, width, height); } }
Currently the Canvas item only supports the two-dimensional rendering context.
Threaded Rendering and Render Target
The Canvas item supports two render targets: Canvas.Image
and Canvas.FramebufferObject
.
The Canvas.Image
render target is a QImage object. This render target supports background thread rendering, allowing complex or long running painting to be executed without blocking the UI. This is the only render target that is supported by all Qt Quick backends.
The Canvas.FramebufferObject render target utilizes OpenGL hardware acceleration rather than rendering into system memory, which in many cases results in faster rendering. Canvas.FramebufferObject relies on the OpenGL extensions GL_EXT_framebuffer_multisample
and GL_EXT_framebuffer_blit
for antialiasing. It will also use more graphics memory when rendering strategy is anything other than Canvas.Cooperative. Framebuffer objects may not be available with Qt Quick backends other than OpenGL.
The default render target is Canvas.Image and the default renderStrategy is Canvas.Immediate.
Pixel Operations
All HTML5 2D context pixel operations are supported. In order to ensure improved pixel reading/writing performance the Canvas.Image render target should be chosen. The Canvas.FramebufferObject render target requires the pixel data to be exchanged between the system memory and the graphic card, which is significantly more expensive. Rendering may also be synchronized with the V-sync signal (to avoid screen tearing) which will further impact pixel operations with Canvas.FrambufferObject
render target.
Tips for Porting Existing HTML5 Canvas Applications
Although the Canvas item provides an HTML5-like API, HTML5 canvas applications need to be modified to run in the Canvas item:
- Replace all DOM API calls with QML property bindings or Canvas item methods.
- Replace all HTML event handlers with the MouseArea item.
- Change setInterval/setTimeout function calls with the Timer item or the use of requestAnimationFrame().
- Place painting code into the
onPaint
handler and trigger painting by calling the markDirty() or requestPaint() methods. - To draw images, load them by calling the Canvas's loadImage() method and then request to paint them in the
onImageLoaded
handler.
Starting Qt 5.4, the Canvas is a texture provider and can be used directly in ShaderEffects and other classes that consume texture providers.
Note: In general large canvases, frequent updates, and animation should be avoided with the Canvas.Image render target. This is because with accelerated graphics APIs each update will lead to a texture upload. Also, if possible, prefer QQuickPaintedItem and implement drawing in C++ via QPainter instead of the more expensive and likely less performing JavaScript and Context2D approach.
See also Context2D and QQuickPaintedItem.
Property Documentation
Holds the logical canvas size that the context paints on.
By default, the canvas size is the same size as the current canvas item size.
By setting the canvasSize, tileSize and canvasWindow, the Canvas item can act as a large virtual canvas with many separately rendered tile rectangles. Only those tiles within the current canvas window are painted by the Canvas render engine.
See also tileSize and canvasWindow.
Holds the active drawing context.
If the canvas is ready and there has been a successful call to getContext() or the contextType property has been set with a supported context type, this property will contain the current drawing context, otherwise null.
The type of drawing context to use.
This property is set to the name of the active context type.
If set explicitly the canvas will attempt to create a context of the named type after becoming available.
The type name is the same as used in the getContext() call, for the 2d canvas the value will be "2d".
See also getContext() and available.
Holds the current canvas rendering strategy.
- Canvas.Immediate - context will perform graphics commands immediately in the main UI thread.
- Canvas.Threaded - context will defer graphics commands to a private rendering thread.
- Canvas.Cooperative - context will defer graphics commands to the applications global render thread.
This hint is supplied along with renderTarget to the graphics context to determine the method of rendering. A renderStrategy, renderTarget or a combination may not be supported by a graphics context, in which case the context will choose appropriate options and Canvas will signal the change to the properties.
Configuration or runtime tests may cause the QML Scene Graph to render in the GUI thread. Selecting Canvas.Cooperative
, does not guarantee rendering will occur on a thread separate from the GUI thread.
The default value is Canvas.Immediate
.
See also renderTarget.
Holds the current canvas render target.
- Canvas.Image - render to an in memory image buffer.
- Canvas.FramebufferObject - render to an OpenGL frame buffer
This hint is supplied along with renderStrategy to the graphics context to determine the method of rendering. A renderStrategy, renderTarget or a combination may not be supported by a graphics context, in which case the context will choose appropriate options and Canvas will signal the change to the properties.
The default render target is Canvas.Image
.
Signal Documentation
This signal is emitted when an image has been loaded.
The corresponding handler is onImageLoaded
.
See also loadImage().
paint(rect region) |
This signal is emitted when the region needs to be rendered. If a context is active it can be referenced from the context property.
This signal can be triggered by markdirty(), requestPaint() or by changing the current canvas window.
The corresponding handler is onPaint
.
This signal is emitted after all context painting commands are executed and the Canvas has been rendered.
The corresponding handler is onPainted
.
Method Documentation
This function will cancel the animation callback referenced by handle.
Returns a drawing context, or null
if no context is available.
The contextId parameter names the required context. The Canvas item will return a context that implements the required drawing mode. After the first call to getContext, any subsequent call to getContext with the same contextId will return the same context object.
If the context type is not supported or the canvas has previously been requested to provide a different and incompatible context type, null
will be returned.
Canvas only supports a 2d context.
isImageError(url image) |
Returns true if the image failed to load.
See also loadImage().
isImageLoaded(url image) |
Returns true if the image is successfully loaded and ready to use.
See also loadImage().
isImageLoading(url image) |
Returns true if the image is currently loading.
See also loadImage().
loadImage(url image) |
Loads the given image
asynchronously.
When the image is ready, imageLoaded will be emitted. The loaded image can be unloaded by the unloadImage() method.
Note: Only loaded images can be painted on the Canvas item.
See also unloadImage, imageLoaded, isImageLoaded(), Context2D::createImageData(), and Context2D::drawImage().
markDirty(rect area) |
Mark the given area as dirty, so that when this area is visible the canvas renderer will redraw it. This will trigger the paint
signal.
See also paint and requestPaint().
This function schedules callback to be invoked before composing the Qt Quick scene.
Request the entire visible region be re-drawn.
See also markDirty().
Save the current canvas content into an image file filename. The saved image format is automatically decided by the filename's suffix.
Note: calling this method will force painting the whole canvas, not just the current canvas visible window.
See also canvasWindow, canvasSize, and toDataURL().
Returns a data URL for the image in the canvas.
The default mimeType is "image/png".
See also save().
unloadImage(url image) |
Unloads the image
.
Once an image is unloaded it cannot be painted by the canvas context unless it is loaded again.
See also loadImage(), imageLoaded, isImageLoaded(), Context2D::createImageData(), and Context2D::drawImage.


FROM THE DESK OF MASSAN AHMED BILL AND EXCHANGE MANAGER, BANK OF AFRICA (BOA) OUAGADOUGOU, BURKINA FASO. Dear Sir, I am the manager of bill and exchange foreign remittance at the department of Bank Of Africa (BOA). In my departmentn we discovered an abandone sum of $ 22.6 m US dollars (Twenty two Millon six hundred thousand US dollars) . In an account that belongs to one of our foreign customer who died along with his entire family in a concord plane crash in the year 2000 in paris that almost took the whole life of the pasengeres on board. Since we got information about his death, we have been expecting his next of kin to come over and claim his money because we cannot release it unless somebody applies for it as next of kin or relation to the deceased as indicated in our banking guidelines but unfortunately we learnt that all his supposed next of kin or relation died alongside with him at the plane crash leaving nobody behind for the claim. It is therefore upon this discovery that I and other officials in my depar tment now decided to make this businness proposal to you and release the money to you as the next of kin or relation to the deceased for safety and subsequent disbursement since nobody is coming for it and we don;t want this money to go into the Bank treasury as unclaimed Bill. The Banking law and guideline here stipulates that if such money remained unclamed after ten years, the money will be transfered into the Bank treasury account as unclaimed fund. The request of foreigner as next of kin in this business is occasioned by the fact that the customer was a foreigner and a Burkinabe cannot stand as next of kin to a foreigner. We agree that 30 % of this money will be for you as foreign partner, in respect to the provision of a foreign account, 10 % will be set aside for expenses incured during the business and 60 % would be for ;me and my colleagues. Thereafter I and my colleagues will visit your country for disbursement accoding to the percentages indicated. Therefore to enable the immediate trnansfer of this fund to you as arranged, you must apply first to the bank as relations or next of kin of the deceased indicating your bank name, your bank account number, your private telephone and fax number for easy and effective communication and location where in the money will be remitted. Upon receipt of your reply, I will send to you by fax or email the text of the application. I will not fail to bring to your notice that this transaction is hitch free and that you should not entertain any atom of fear as all required arrangements have been made for the transfer. You should contact me immediately as soon as you receive this letter. Trusting to hear from you immediately. Your;s faithfully, MR.MASSAN AHMED (Bill and exchange manager) BANK OF AFRICA (BOA). _________________________________________________________________ MSN Hotmail sur i-mode� : envoyez et recevez des e-mails depuis votre téléphone portable ! http://www.msn.fr/hotmailimode/