Added example of regex checking for IAM arns (#144)

* Added example of regex checking for IAM arns

* Fixed line formatting

* Fixed lint issues

* Bugfix: role patterns

* Fix: Removed 2 lines - unnecessary return

* Added test case for role pattern

* Changed test case so it reaches the intended condition

* Fixed tests

aws_cloudtrail_rules/aws_iam_entity_created_without_cloudformation.py

@@ -1,30 +1,45 @@
+import re
+
 # The role dedicated for IAM administration
 IAM_ADMIN_ROLES = {
-    'arn:aws:iam::123456789012:role/IdentityCFNServiceRole',
+    "arn:aws:iam::123456789012:role/IdentityCFNServiceRole",
 }
 
+# The role patterns dedicated for IAM Service Roles
+IAM_ADMIN_ROLE_PATTERNS = {"arn:aws:iam::[0-9]+:role/IdentityCFNServiceRole"}
+
 # API calls that are indicative of IAM entity creation
 IAM_ENTITY_CREATION_EVENTS = {
-    'BatchCreateUser',
-    'CreateGroup',
-    'CreateInstanceProfile',
-    'CreatePolicy',
-    'CreatePolicyVersion',
-    'CreateRole',
-    'CreateServiceLinkedRole',
-    'CreateUser',
+    "BatchCreateUser",
+    "CreateGroup",
+    "CreateInstanceProfile",
+    "CreatePolicy",
+    "CreatePolicyVersion",
+    "CreateRole",
+    "CreateServiceLinkedRole",
+    "CreateUser",
 }
 
 
 def rule(event):
     # Check if this event is in scope
-    if event['eventName'] not in IAM_ENTITY_CREATION_EVENTS:
+    if event["eventName"] not in IAM_ENTITY_CREATION_EVENTS:
         return False
 
     # All IAM changes MUST go through CloudFormation
-    if event['userIdentity'].get('invokedBy') != 'cloudformation.amazonaws.com':
+    if event["userIdentity"].get("invokedBy") != "cloudformation.amazonaws.com":
         return True
 
     # Only approved IAM Roles can make IAM Changes
-    return event['userIdentity']['sessionContext']['sessionIssuer'][
-        'arn'] not in IAM_ADMIN_ROLES
+    for admin_role_pattern in IAM_ADMIN_ROLE_PATTERNS:
+        # Check if the arn matches any role patterns, returns False (whitelisting it) if there is a match
+        if (len(
+                re.findall(
+                    admin_role_pattern,
+                    event["userIdentity"]["sessionContext"]["sessionIssuer"]
+                    ["arn"],
+                )) > 0):
+            return False
+
+    return (event["userIdentity"]["sessionContext"]["sessionIssuer"]["arn"]
+            not in IAM_ADMIN_ROLES)

aws_cloudtrail_rules/aws_iam_entity_created_without_cloudformation.yml

@@ -106,6 +106,49 @@ Tests:
           "eventType": "AwsApiCall",
           "recipientAccountId": "123456789012"
       }
+  -
+    Name: IAM Entity Created Manually With Approved Role Pattern
+    ExpectedResult: false
+    Log:
+      {
+          "eventVersion": "1.05",
+          "userIdentity": {
+              "type": "AssumedRole",
+              "principalId": "1111:tester",
+              "arn": "arn:aws:sts::123456789012:assumed-role/tester",
+              "accountId": "123456789012",
+              "accessKeyId": "1",
+              "invokedBy": "cloudformation.amazonaws.com",
+              "sessionContext": {
+                  "attributes": {
+                      "mfaAuthenticated": "true",
+                      "creationDate": "2019-01-01T00:00:00Z"
+                  },
+                  "sessionIssuer": {
+                      "type": "Role",
+                      "principalId": "1111",
+                      "arn": "arn:aws:iam::210987654321:role/IdentityCFNServiceRole",
+                      "accountId": "123456789012",
+                      "userName": "tester"
+                  }
+              }
+          },
+          "eventTime": "2019-01-01T00:00:00Z",
+          "eventSource": "iam.amazonaws.com",
+          "eventName": "CreateUser",
+          "awsRegion": "us-east-1",
+          "sourceIPAddress": "111.111.111.111",
+          "userAgent": "console.amazonaws.com",
+          "requestParameters": {
+              "userName": "user",
+              "path": "/"
+          },
+          "responseElements": null,
+          "requestID": "1",
+          "eventID": "1",
+          "eventType": "AwsApiCall",
+          "recipientAccountId": "123456789012"
+      }
   -
     Name: IAM Entity Created Manually
     ExpectedResult: true