T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:43
- Finding
- Documented IAM Policy Grants Permissions Beyond the Export Workflow## Vulnerability Details **File Location**: `SKILL.md`, lines 43–50 **Vulnerability Type**: Excessive IAM permissions and violation of least privilege **Risk Level**: Medium ### Vulnerable Code ```json { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": ["cloudtrail:LookupEvents", "cloudtrail:GetTrail", "logs:FilterLogEvents", "logs:GetLogEvents"], "Resource": "*" }] } ``` ### Technical Analysis The policy is presented as the minimum IAM permission set required to execute the documented export commands. However, those commands use only `cloudtrail:LookupEvents` and `logs:FilterLogEvents`. The policy additionally grants: - `cloudtrail:GetTrail`, which permits retrieval of CloudTrail configuration information. - `logs:GetLogEvents`, which permits direct access to events in CloudWatch log streams. These additional actions are not required by the commands shown in the Skill. Moreover, `"Resource": "*"` does not restrict CloudWatch Logs access to the intended CloudTrail log group. Where supported by the relevant action, this can expose unrelated log groups or streams accessible under the policy. The Skill itself does not apply this policy or access AWS directly. Exploitation therefore requires a user to copy and attach the documented policy to an IAM principal. The risk arises because the policy is described as “minimum required,” making it likely that users will trust and deploy it without further restriction. ### Attack Path 1. A user follows the Skill documentation and attaches the supplied policy to an IAM user or role used for log export. 2. The resulting principal receives `cloudtrail:GetTrail` and `logs:GetLogEvents`, although the documented export commands do not need them. 3. An attacker compromises the principal's session or credentials, or an authorized operator misuses the excessive access. 4. The attacker enumerates CloudTrail configuration through `cloudtrai ...[truncated 1135 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `cloudtrail:GetTrail` and `logs:GetLogEvents` from the policy unless a separately documented workflow demonstrably requires them. 2. Provide separate policies for the CloudTrail lookup and CloudWatch Logs export workflows so users grant only the permissions needed for the workflow they select. 3. For the CloudWatch workflow, scope supported actions to the specific CloudTrail log-group and log-stream ARNs rather than using `"Resource": "*"`. 4. Retain wildcard resources only for actions that do not support resource-level restrictions, and document why the wildcard is technically required. 5. Rename the example if it is intentionally broad; do not characterize it as the “minimum required” policy. 6. Recommend temporary role sessions, short session durations, permission boundaries, and monitoring for unexpected log access. 7. Validate the revised policy with AWS IAM Access Analyzer and test each documented command against the restricted role. A minimal policy should contain only the actions needed for the selected export method, with CloudWatch resources restricted to the user-specified CloudTrail log group wherever AWS supports such restriction.