[WIP] Check for single node sts:AssumeRole cycles #113
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When a role attempts to assume it self an explicit allow in the trust policy is not strictly necessary for access. An explicit
allow in the identity policy is sufficient.
This applies to the circular access check because role revocations do not effect very recently refreshed credentials. When a role can assume it self, a bash loop calling
aws sts assume-role
and exporting the new credentials to the environment will bypass a revocation triggered through the web UI.I still need to add tests, etc.. just wanted to open this in the mean time in case anyone has any thoughts on this.
Edit: Ok, just read the contributing section, I'll need to change the base and open an issue as well.