3 ms·
This article is grasping pretty hard. You mean to tell me if a role was misconfigured to allow anyone to assume it, and someone guesses that role name, then the
by cloakandswagger 8y ago
This article is grasping pretty hard. You mean to tell me if a role was misconfigured to allow anyone to assume it, and someone guesses that role name, then they'll be able to assume it?!
The only part of the article that is interesting is the difference in error messages that allows you to confirm whether a role exists or not, but I suspect that wasn't enough content for a blog post so the scary implications of misconfiguring security policies was thrown in.
- dixie_land 8y agoExactly, it's the equivalent of saying "did you know if you have an admin account with blank password and I guessed the username then I can do some serious damage?"
- some_account 8y agoIf the policy has AssumeRole with principal "AWS:*" then yes, anyone can assume it and get temporary credentials to resources. Normally you would put an account number there but what if you want all your accounts to be able to assume the role and want a quick solution? I think a lot of people didn't realize that anyone on AWS can assume the role if they do this. I think it's quite common for people to just put something in the policy that works on order to quickly proceed with whatever they are doing. Article says they found about 50 policies like this.