Feature search
Which component would this feature affect?
Prowler API
Related to specific cloud provider?
AWS
New feature motivation
Background
In complex AWS setups, it is not uncommon to have equally complex access control frameworks and procedures. There must be a way to support this kind of access control in Prowler API.
Solution Proposed
Proposed Solution
Implement ordered role_chain support in the API payload for advanced AWS setups that require multiple sequential sts:AssumeRole hops, keeping existing single-hop fields for backward compatibility.
Proposed Example
{
"data": {
"type": "provider-secrets",
"attributes": {
"secret_type": "role",
"secret": {
"aws_access_key_id": "AKIA...",
"aws_secret_access_key": "...",
"role_chain": [
{
"role_arn": "arn:aws:iam::111111111111:role/BootstrapRole",
"external_id": "bootstrap-ext",
"role_session_name": "prowler-hop-1",
"session_duration": 3600
},
{
"role_arn": "arn:aws:iam::222222222222:role/FinalScanRole",
"role_session_name": "prowler-hop-2",
"session_duration": 3600
}
]
}
},
"relationships": {
"provider": {
"data": {
"type": "providers",
"id": "<provider-id>"
}
}
}
}
}Use case and benefits
Value Proposition
The proposed feature will be backwards compatible, so that complex AWS landing zones will greatly benefit from the least amount of change to manage on their end.
Describe alternatives you've considered
Options considered
Establish Trust Relationship with the Target AWS Accounts
This introduces friction, and almost always needs to go through a lengthy security gate with the AWS Account owners due to the introduction of new access.
Dynamic AWS Configuration
In this approach the hopping-style is preserved and the ~/.aws/config is dynamically created according to the role chain specifications. There is a lot of spaghetti integration scripts to do to achieve this.
Additional context
No response
Feature search
Which component would this feature affect?
Prowler API
Related to specific cloud provider?
AWS
New feature motivation
Background
In complex AWS setups, it is not uncommon to have equally complex access control frameworks and procedures. There must be a way to support this kind of access control in Prowler API.
Solution Proposed
Proposed Solution
Implement ordered
role_chainsupport in the API payload for advanced AWS setups that require multiple sequentialsts:AssumeRolehops, keeping existing single-hop fields for backward compatibility.Proposed Example
{ "data": { "type": "provider-secrets", "attributes": { "secret_type": "role", "secret": { "aws_access_key_id": "AKIA...", "aws_secret_access_key": "...", "role_chain": [ { "role_arn": "arn:aws:iam::111111111111:role/BootstrapRole", "external_id": "bootstrap-ext", "role_session_name": "prowler-hop-1", "session_duration": 3600 }, { "role_arn": "arn:aws:iam::222222222222:role/FinalScanRole", "role_session_name": "prowler-hop-2", "session_duration": 3600 } ] } }, "relationships": { "provider": { "data": { "type": "providers", "id": "<provider-id>" } } } } }Use case and benefits
Value Proposition
The proposed feature will be backwards compatible, so that complex AWS landing zones will greatly benefit from the least amount of change to manage on their end.
Describe alternatives you've considered
Options considered
Establish Trust Relationship with the Target AWS Accounts
This introduces friction, and almost always needs to go through a lengthy security gate with the AWS Account owners due to the introduction of new access.
Dynamic AWS Configuration
In this approach the hopping-style is preserved and the
~/.aws/configis dynamically created according to the role chain specifications. There is a lot of spaghetti integration scripts to do to achieve this.Additional context
No response