Feature requests: flag principals with the permission policy "ReadOnlyAccess"

[rdegraaf]

Is your feature request related to a problem? Please describe.

Use of the AWS-managed permission policy "ReadOnlyAccess" is not necessarily a problem: it has completely valid uses. However, many administrators don't fully appreciate what it can do and give it out too freely. A principal with ReadOnlyAccess can read nearly everything in an account. This includes the ability to:

• Get configuration for just about everything.
• Read anything from any S3 Bucket (s3:GetObject, s3:GetObjectVersion, s3:GetObjectTorrent).
• Read anything from any DynamoDB table (dynamodb:GetItem, dynamodb:BatchGetItem).
• Read query logs from RDS (rds:DownloadCompleteDBLogFile, rds:DownloadDBLogFilePortion).
• Retrieve EC2 Instance metadata, including user data (ec2:DescribeInstanceAttribute).
• Read system console output from running EC2 Instances (ec2:GetConsoleOutput).
• Take screen captures from running EC2 Instances (ec2:GetConsoleScreenshot).
• Retrieve encrypted administrator passwords for EC2 Instances running Windows (ec2:GetPasswordData).
• Retrieve environment variables for Lambda Functions (lambda:GetFunction, lambda:GetFunctionConfiguration).
• Read Lambda Function source code (lambda:GetFunction, lambda:GetLayerVersion).
• Retrieve parameters from SSM Parameter Stores (ssm:GetParameter, ssm:GetParameters, ssm:GetParameterHistory).

Notably, ReadOnlyAccess does not include the ability to read Secrets from Secrets Manager. However, we all know that secrets are often found in inappropriate places like source code, S3 objects, Lambda Function environment variables, SSM Parameter Stores, and EC2 Instance user data, all of which are accessible using ReadOnlyAccess.

Some administrators combine ReadOnlyAccess with Deny statements to prevent principals from reading certain sensitive data. However, these deny-lists often have problems, as discussed in #1576.

Describe the solution you'd like

ScoutSuite should flag principals with the permission policy ReadOnlyAccess attached so that a reviewer can verify that they are appropriate given the account's access control regime and requirements.

[issabayevmk]

Can someone assign this issue to me, I would like to contribute

[rdegraaf]

@issabayevmk I don't have permission to assign issues, but you don't need it to be assigned to contribute -- you can fork the repository into your own account, make the changes there, and submit a merge request. I do have ways to poke the lead devs once your MR is ready.

With you having declared your interest here, it's safe to say that no one else will attempt to start on this issue any time soon.

[issabayevmk]

PR is here #1638