1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99

# main.tf — IAM violations fixture
# Triggers all 6 IAM policy violations

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

# IAM-006 — Hardcoded credentials in provider block
provider "aws" {
  region     = "ap-south-1"
  access_key = "AKIAS3ZBGQD4PAB4RPYY"
  secret_key = "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"
}

# IAM-001 — Policy attached directly to user
resource "aws_iam_user" "bad_user" {
  name = "bad-user"
}

resource "aws_iam_user_policy" "bad_inline" {
  name = "bad-inline-policy"
  user = aws_iam_user.bad_user.name
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["s3:GetObject"]
      Resource = "*"
    }]
  })
}

resource "aws_iam_policy" "bad_policy" {
  name = "bad-managed-policy"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["s3:GetObject"]
      Resource = "*"
    }]
  })
}

resource "aws_iam_user_policy_attachment" "bad_attachment" {
  user       = aws_iam_user.bad_user.name
  policy_arn = aws_iam_policy.bad_policy.arn
}

# IAM-002 — Long-term IAM access key
resource "aws_iam_access_key" "bad_key" {
  user = aws_iam_user.bad_user.name
}

# IAM-003 — Broad KMS permissions in inline role policy
resource "aws_iam_role" "app_role" {
  name = "app-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "ec2.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
  # IAM-004 — No permissions_boundary set
}

resource "aws_iam_role_policy" "bad_kms" {
  name = "bad-kms-policy"
  role = aws_iam_role.app_role.name
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["kms:Decrypt"]
      Resource = "*"
    }]
  })
}

# IAM-005 — Cross-account trust with Principal * and no Condition
resource "aws_iam_role" "bad_cross_account" {
  name = "bad-cross-account-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = "*"
      Action    = "sts:AssumeRole"
    }]
  })
  # IAM-004 — No permissions_boundary set (second violation)
}