iam_role_cross_service_confused_deputy_prevention

[NMuee]

Hello Prowler team,

I am trying to remediate this above finding "iam_role_cross_service_confused_deputy_prevention"

However, from my understanding, it seems like not all services support "aws:SourceAccount" or "aws:SourceArn".

Example: "codepipeline.amazonaws.com" and "apigateway.amazonaws.com"

My update from AWS support is that not all service principals support these conditions.

What are your view on this? Should services that are not supported not be flagged as FAIL?

Thank you

[MrCloudSec]

HI @NMuee, great point!

We will do some research to see which similar conditions can be applied to those kind of services.

[MrCloudSec]

@NMuee did AWS support send you the services that support these conditions?
We are going to add aws:PrincipalAccount and aws:ResourceAccount conditions too, maybe those are supported by the mentioned services.

[NMuee]

Nope, they said they need to investigate with their internal team and will add this into their research work

[NMuee]

I can give it a try for the above condition keys you mentioned to services that don't ingest SourceAccount/SourceArn

[foxdrodd]

Did someone find some new information on howto verify if the confused deputy finding is applicable or not? I have a hard time evaluate each finding and decide wether the service supports the conditions and if the service is able to use another accounts service role.