fix(terraform): improve the adaptation of IAM resources

[nikpivkin]

See aquasecurity/trivy#5013

Also fixed aquasecurity/trivy#5452

[nikpivkin]

@simar7 Do we need to verify that IAM resources have the same provider? . Why is it only present on theirs? AWS documentation says that IAM services are not region specific:

The resources that you create in one Region do not exist in any other Region unless you explicitly use a replication feature offered by an AWS service. For example, Amazon S3 and Amazon EC2 support cross-Region replication. Some services, such as AWS Identity and Access Management (IAM), do not have Regional resources.

I have successfully created the following IAC:

provider "aws" {
  region = "us-east-1"
  alias  = "us-east"
}

provider "aws" {
  region = "us-west-1"
  alias  = "us-west"
}

resource "aws_iam_role_policy" "this" {
  provider = aws.us-east
  name     = "test_policy"
  role     = aws_iam_role.this.id

  # Terraform's "jsonencode" function converts a
  # Terraform expression result to valid JSON syntax.
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "ec2:Describe*",
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })
}

resource "aws_iam_role" "this" {
  provider = aws.us-west
  name     = "test_role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Sid    = ""
        Principal = {
          Service = "ec2.amazonaws.com"
        }
      },
    ]
  })
}

As you can see, I've used different provider configurations for role and policy, but it doesn't affect anything.

aws_iam_role.this: Creating...
aws_iam_role.this: Creation complete after 2s [id=test_role]
aws_iam_role_policy.this: Creating...
aws_iam_role_policy.this: Creation complete after 1s [id=test_role:test_policy]

But through the github search I found where separate provider configurations are used for IAM services, am I missing something?

• https://github.com/alphagov/paas-cf/blob/8b9c80bda36b91fe9665af3f1ad59c04bdb8ab56/terraform/cloudfoundry/smtp.tf#L10

Ref:

• https://developer.hashicorp.com/terraform/language/meta-arguments/resource-provider
• https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-regions.html

[simar7]

As per your example

resource "aws_iam_role_policy" "this" {
  provider = aws.us-east
  name     = "test_policy"
  role     = aws_iam_role.this.id

Does the provider attribute exist? I don't see it document in terraform docs https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy#argument-reference - this omission makes sense to me because IAM is region agnostic as you pointed out.

As for the same provider code, I'm not sure. Have you checked git blame history in older version of defsec to see why it was added?

[nikpivkin]

@simar7 provider is a meta-argument https://developer.hashicorp.com/terraform/language/meta-arguments/resource-provider

[simar7]

@simar7 provider is a meta-argument https://developer.hashicorp.com/terraform/language/meta-arguments/resource-provider

ah I missed that. I would assume aws doesn't care about it as IAM is region agnostic. I was reading the docs for the CLI and they do expose a region option (not sure why) my guess it was autogenerated doc and region is just a global option. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-policy.html

But if you see the IAM ARN info page, they talk about region is always kept blank https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns

[simar7]

Could the check be in place to resolve such issues? https://stackoverflow.com/a/66859239

[nikpivkin]

@simar7 Which check do you mean?

[nikpivkin]

As for the same provider code, I'm not sure. Have you checked git blame history in older version of defsec to see why it was added?

I couldn't find any information on why the check was added:
https://github.com/aquasecurity/tfsec/pull/1361/files#diff-f6a469bc57cae0a81fc6120d0e65ee7b84ef208726e49c39a6dc09c9113cc33a

[simar7]

@nikpivkin looks like there are some merge conflicts to resolve.

[nikpivkin]

@simar7 Done.