Fix CRLY.01176: Constrain IAM Write Access

[curly-review]

Issue Details

ID: CRLY.01176
Severity: HIGH
File: pipeline/cfn-deploypipeline-github.yaml

---

Remediation Summary

Description

The IAM policy associated with the PipelineExecutionRole allows unrestricted write access, which is a security risk. This policy should be updated to constrain write access to only necessary resources.

Steps

1. Identify the IAM Policy: Locate the PolicyDocument within the Policies section of the PipelineExecutionRole.

2. Update the Policy: Modify the PolicyDocument to restrict write actions to specific resources. Below is an example of how you can update the policy to restrict iam:PassRole and lambda:InvokeFunction actions to specific resources.

    PipelineExecutionRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Action:
                - 'sts:AssumeRole'
              Effect: Allow
              Principal:
                Service:
                  - codepipeline.amazonaws.com
        Path: /
        ManagedPolicyArns:
          - 'arn:aws:iam::aws:policy/AmazonS3FullAccess'
          - !Ref CFNPipelinePolicy
        Policies:
          - PolicyName: CodePipelineAccess
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Action:
                    - 'iam:PassRole'
                    - 'lambda:InvokeFunction'
                    - 'lambda:ListFunctions'
                    - 'lambda:InvokeAsync'
                  Effect: Allow
                  Resource:
                    - arn:aws:iam::123456789012:role/specific-role
                    - arn:aws:lambda:us-east-1:123456789012:function:specific-function

3. Deploy the Updated Template: After updating the policy, redeploy the CloudFormation template to apply the changes.

aws cloudformation deploy --template-file pipeline/cfn-deploypipeline-github.yaml --stack-name your-stack-name

By following these steps, you will ensure that the IAM policy does not allow write access without constraints, thereby improving the security of your AWS environment.