cloud-iam-security

Guide complet de sécurité IAM multi-cloud — AWS IAM, GCP IAM, Azure RBAC/AD, politiques, rôles, fédération d'identité, moindre privilège, analyse des chemins de privesc, et durcissement

الانتقال إلى التثبيت

المستودع: JohnNuwan/EVA_CORE
آخر نشاط في المصدر: ٢١ يوليو ٢٠٢٦ في ٢٣:٢٢
لغة SKILL.md المكتشفة: الفرنسية
النجوم: ٠
التفرعات: ٠

خيارات التثبيت

يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.

مراجعة ملفات المصدر

اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.

العودة إلى البحث العودة إلى التثبيت

name	cloud-iam-security
description	Guide complet de sécurité IAM multi-cloud — AWS IAM, GCP IAM, Azure RBAC/AD, politiques, rôles, fédération d'identité, moindre privilège, analyse des chemins de privesc, et durcissement
category	cybersecurite

Cloud IAM Security — AWS / GCP / Azure

1. AWS IAM

Structure IAM AWS

┌─────────────────────────────────────────────┐
│                   AWS Root                    │
├─────────────────────────────────────────────┤
│  Users (personnes)  │  Roles (services)     │
│  Groups (collection) │  Policies (droits)    │
│  Service Accounts <=> │  Instance Profiles    │
│  SAML/OIDC Providers  │  Permission Boundaries│
│  Organizations (SCP)  │  Access Analyzer     │
└─────────────────────────────────────────────┘

Types de Politiques

# 1. AWS Managed Policies (prédéfinies par AWS)
arn:aws:iam::aws:policy/AdministratorAccess
arn:aws:iam::aws:policy/ReadOnlyAccess

# 2. Customer Managed Policies (créées par vous)
aws iam create-policy --policy-name custom-policy --policy-document file://policy.json

# 3. Inline Policies (attachées directement à un user/role)
aws iam put-user-policy --user-name <user> --policy-name inline-policy --policy-document file://policy.json

# 4. Resource-based Policies (attachées à la ressource)
# S3 bucket policy, KMS key policy, Lambda resource policy
aws s3api put-bucket-policy --bucket <name> --policy file://bucket-policy.json

# 5. Service Control Policies (SCP — AWS Organizations)
# Limite les permissions max dans un compte
aws organizations create-policy --content file://scp.json --name "DenyRootAccess" --type SERVICE_CONTROL_POLICY

# 6. Permission Boundaries
# Définit le maximum de permissions qu'un IAM principal peut avoir

Évaluation des Politiques IAM

# Simulateur de politique
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::<account>:user/<user> \
  --action-names s3:ListBucket ec2:DescribeInstances iam:CreateUser

# Policy Simulator complet
# https://policysim.aws.amazon.com/

# Access Analyzer — validation
aws accessanalyzer validate-policy --policy-type IDENTITY_POLICY --policy-document file://policy.json

Chemins de Privesc IAM

Permission	Attaque
`iam:CreatePolicyVersion`	Créer une version admin d'une politique
`iam:SetDefaultPolicyVersion`	Changer la version active
`iam:CreateAccessKey`	Créer une clé pour un autre user
`iam:UpdateLoginProfile`	Changer le mot de passe d'un autre user
`iam:PassRole`	Passer un rôle à un service
`iam:CreateUser` + `iam:AttachUserPolicy`	Créer un user admin
`iam:UpdateAssumeRolePolicy`	Modifier le trust policy
`sts:AssumeRole`	Usurper un rôle
`lambda:UpdateFunctionCode`	Backdoor une Lambda
`ec2:RunInstances` + `iam:PassRole`	Lancer une instance avec un rôle privilégié

# Analyse PMapper
pip install pmapper
pmapper --profile default query 'presigned privesc'
pmapper --profile default query 'can privesc to *'
pmapper --profile default visualize
pmapper --profile default query 'who can do iam:CreateUser'

AWS Organizations

# SCP — bloquer les actions dangereuses
cat > scp-deny-leave-org.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Deny",
    "Action": [
      "organizations:LeaveOrganization",
      "organizations:DeleteOrganization",
      "iam:CreateAccessKey",
      "iam:CreateUser"
    ],
    "Resource": "*"
  }]
}
EOF
aws organizations create-policy --content file://scp-deny-leave-org.json --name "SCP-Deny-Dangerous" --type SERVICE_CONTROL_POLICY

# SCP — deny root access keys
aws organizations create-policy --content file://scp-root-no-keys.json --name "DenyRootAccessKeys" --type SERVICE_CONTROL_POLICY

Hardening IAM AWS

# 1. No inline policies
aws iam list-user-policies --user-name <user>  # doit être vide

# 2. No access keys for root
aws iam get-account-summary | grep AccountAccessKeysPresent

# 3. MFA for all human users
aws iam list-virtual-mfa-devices

# 4. Password policy forte
aws iam update-account-password-policy --minimum-password-length 16 --require-symbols

# 5. Conditions dans les politiques
# Exemple: deny access outside VPC
"Condition": {
  "StringNotEquals": {
    "aws:SourceVpc": "vpc-12345678"
  }
}

# 6. Permission Boundaries
aws iam put-user-permissions-boundary --user-name <user> --permissions-boundary arn:aws:iam::...:policy/boundary

# 7. Access Analyzer — détection des accès externes
aws accessanalyzer create-analyzer --analyzer-name prod-analyzer --type ACCOUNT
aws accessanalyzer list-findings --analyzer-arn <arn>

2. GCP IAM

Structure IAM GCP

┌──────────────────────────────────────────────┐
│          Organization (<org>)                  │
├──────────────────────────────────────────────┤
│  Folders (hiérarchie)                          │
│  Projects (ressources)                         │
│  Service Accounts (identités non-humaines)    │
│  Roles (prédéfinis, custom, primitifs)        │
│  Members (user, group, SA, domain, allUsers)  │
│  Conditions (context-aware)                    │
│  Workload Identity Federation (OIDC/SAML)     │
└──────────────────────────────────────────────┘

Types de Rôles GCP

# 1. Rôles primitifs (à éviter)
# roles/owner, roles/editor, roles/viewer

# 2. Rôles prédéfinis
# roles/storage.objectViewer, roles/compute.admin

# 3. Rôles custom
gcloud iam roles create CustomRole --project <project> --title "Custom Role" --permissions storage.objects.list,storage.objects.get

# 4. Rôles de base (Basic Roles) — dépréciés
# Utiliser des rôles prédéfinis ou custom

Service Accounts GCP

# Création
gcloud iam service-accounts create <name> --display-name "My SA"

# Attribution de rôles
gcloud projects add-iam-policy-binding <project> \
  --member "serviceAccount:<name>@<project>.iam.gserviceaccount.com" \
  --role "roles/storage.admin"

# Création de clés
gcloud iam service-accounts keys create key.json \
  --iam-account <name>@<project>.iam.gserviceaccount.com

# Workload Identity Federation (OIDC)
gcloud iam workload-identity-pools create <pool> --location global
gcloud iam workload-identity-pools providers create-oidc <provider> \
  --location global \
  --workload-identity-pool <pool> \
  --issuer-uri https://token.actions.githubusercontent.com \
  --attribute-mapping "google.subject=assertion.sub"

Conditions IAM GCP

# Conditions contextuelles
gcloud projects add-iam-policy-binding <project> \
  --member user:admin@domain.com \
  --role roles/compute.admin \
  --condition "expression=request.time < timestamp('2026-12-31T23:59:59Z'),title=expiry"

# Resource-based conditions
gcloud projects add-iam-policy-binding <project> \
  --member user:dev@domain.com \
  --role roles/storage.objectViewer \
  --condition "expression=resource.name.startsWith('projects/_/buckets/dev-'),title=dev-only"

Chemins de Privesc GCP

Permission	Impact
`iam.roles.update`	Modifier un rôle custom
`iam.serviceAccountKeys.create`	Créer une clé pour un autre SA
`iam.serviceAccounts.actAs`	Impersonate un SA
`iam.serviceAccounts.implicitDelegation`	Delegation de SA
`iam.serviceAccounts.getAccessToken`	Obtenir un token OAuth
`compute.instances.setMetadata`	Changer les SSH keys
`compute.instances.setIamPolicy`	Modifier l'IAM d'une instance
`iam.roles.create`	Créer un rôle avec toutes les permissions
`iam.serviceAccounts.setIamPolicy`	Se donner accès à un SA

# Analyser les permissions IAM
gcloud projects get-iam-policy <project> --format json | jq '.bindings[] | select(.role | test("owner|admin|editor"))'

# Trouver les SA avec des clés
gcloud iam service-accounts keys list --iam-account <sa>@<project>.iam.gserviceaccount.com

Hardening IAM GCP

# 1. Pas de rôles primitifs
gcloud projects get-iam-policy <project> --format json | jq '.bindings[] | select(.role | test("roles/owner|roles/editor|roles/viewer"))'

# 2. Désactiver les SA par défaut
gcloud iam service-accounts disable <default-sa>@<project>.iam.gserviceaccount.com

# 3. OS Login — pas de SSH keys manuelles
gcloud compute project-info add-metadata --metadata enable-oslogin=TRUE

# 4. Audit des clés SA
for SA in $(gcloud iam service-accounts list --format="value(email)"); do
  echo "SA: $SA"
  gcloud iam service-accounts keys list --iam-account $SA --managed-by-user
done

# 5. VPC Service Controls
gcloud access-context-manager perimeters create <perimeter> --resources projects/<project>

# 6. Domain Restricted Sharing
# Organisation policy: restrict all users to G Suite domain

3. Azure RBAC & Azure AD

Structure Azure Identity

┌─────────────────────────────────────────────────┐
│               Azure AD (Tenant)                   │
│  Users │ Groups │ Service Principals │ App Regs │
│  Managed Identities │ Conditional Access │ PIM  │
├─────────────────────────────────────────────────┤
│            Azure RBAC (Subscription)              │
│  Role Assignments │ Role Definitions │ Scopes    │
└─────────────────────────────────────────────────┘

Azure RBAC Roles

# Rôles intégrés (Built-in)
# Owner, Contributor, Reader, User Access Administrator
# Key Vault Secrets User, Storage Blob Data Owner, etc.

# Lister les rôles
az role definition list --output table

# Rôles custom
az role definition create --role-definition @custom-role.json

# Exemple custom role
cat > custom-role.json << 'EOF'
{
  "Name": "Storage Auditor",
  "IsCustom": true,
  "Description": "Read-only storage access",
  "Actions": [
    "Microsoft.Storage/storageAccounts/read",
    "Microsoft.Storage/storageAccounts/blobServices/containers/read"
  ],
  "NotActions": [],
  "AssignableScopes": ["/subscriptions/<sub-id>"]
}
EOF

Azure AD — Identités

# Users
az ad user list --output table
az ad user show --id <user>

# Groups
az ad group list --output table
az ad group member list --group <group>

# Service Principals
az ad sp list --output table
az ad sp list --query "[].{DisplayName:displayName, AppId:appId, Type:servicePrincipalType}"

# Application Registrations
az ad app list --output table
az ad app list --query "[].{DisplayName:displayName, AppId:appId, SignInAudience:signInAudience}"

Managed Identities Azure

# System-assigned (liée à une ressource)
az vm identity assign --name <vm> --resource-group <RG>

# User-assigned (indépendante)
az identity create --name <identity> --resource-group <RG>
az vm identity assign --name <vm> --resource-group <RG> --identities <identity-id>

# Obtenir un token depuis la VM
curl "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/" -H "Metadata: true"

Azure AD Privileged Identity Management (PIM)

# PIM — Just-In-Time elevation
# Rôles éligibles vs actifs
# Activation avec approbation + MFA + justification

# Vérifier les rôles PIM
az rest --method get --url "https://management.azure.com/providers/Microsoft.Authorization/roleEligibilityScheduleInstances?api-version=2020-10-01"

# Éligible Owner
az rest --method get --url "https://management.azure.com/providers/Microsoft.Authorization/roleEligibilityScheduleInstances?api-version=2020-10-01&filter=roleDefinitionId eq '8e3af657-a8ff-443c-a75c-2fe8c4bcb635'"

Conditional Access

# Policies de Conditional Access
# Bloque les accès depuis des IP non fiables
# Exige MFA pour les rôles admin
# Bloque les legacy authentication
# Exige device compliance (Intune)

# Azure AD Identity Protection
# Risky users, risky sign-ins
az rest --method get --url "https://graph.microsoft.com/v1.0/identityProtection/riskyUsers"

Chemins de Privesc Azure

Permission RBAC	Impact
`Microsoft.Authorization/roleAssignments/write`	Attribuer n'importe quel rôle
`Microsoft.Authorization/roleDefinitions/write`	Créer/modifier des rôles custom
`Microsoft.ManagedIdentity/userAssignedIdentities/assign/action`	Attacher une MSI
`Microsoft.KeyVault/vaults/write`	Modifier les politiques Key Vault
`Microsoft.Compute/virtualMachines/write`	Exécuter des commandes sur VM
`Microsoft.Authorization/locks/delete`	Supprimer les locks
`Microsoft.Automation/automationAccounts/write`	Modifier des runbooks

# AzureHound — BloodHound pour Azure
# Analyser les chemins de privesc
az ad sp create-for-rbac -n "azurehound" --role "Global Reader"
./AzureHound --tenant <tenant> --username <user> --password <pass>

Hardening Azure Identity

# 1. Legacy authentication bloqué
# Conditional Access: Block legacy auth

# 2. MFA obligatoire
# Conditional Access: Require MFA for all users

# 3. Guest users restriction
az ad user list --query "[?userType=='Guest']" --output table

# 4. Audit des Service Principals
az ad sp list --query "[?passwordCredentials != null || keyCredentials != null]"

# 5. Azure AD Identity Protection
# Risky user policies
# Sign-in risk policies

# 6. PIM pour tous les rôles admin
# Activation just-in-time, approbation, audit

# 7. Pas de rôle Owner au niveau subscription
az role assignment list --all --query "[?roleDefinitionName=='Owner']"

4. Fédération d'Identité Multi-Cloud

AWS — SAML/OIDC Federation

# SAML 2.0
aws iam create-saml-provider --saml-metadata-document file://metadata.xml --name AzureAD

# OIDC (GitHub Actions, GitLab, etc.)
aws iam create-open-id-connect-provider \
  --url https://token.actions.githubusercontent.com \
  --client-id-list sts.amazonaws.com

# Web Identity — assume role with web token
aws sts assume-role-with-web-identity \
  --role-arn arn:aws:iam::<account>:role/GitHubRole \
  --role-session-name github-actions \
  --web-identity-token <token>

GCP — Workload Identity Federation

# OIDC federation avec GitHub Actions
gcloud iam workload-identity-pools create gh-pool --location global
gcloud iam workload-identity-pools providers create-oidc gh-provider \
  --location global \
  --workload-identity-pool gh-pool \
  --issuer-uri https://token.actions.githubusercontent.com \
  --attribute-mapping "google.subject=assertion.sub,attribute.actor=assertion.actor,attribute.repository=assertion.repository" \
  --attribute-condition "assertion.repository_owner == 'my-org'"

# Attribution
gcloud iam service-accounts add-iam-policy-binding <sa>@<project>.iam.gserviceaccount.com \
  --member "principalSet://iam.googleapis.com/projects/<project>/locations/global/workloadIdentityPools/gh-pool/attribute.repository/my-org/*" \
  --role "roles/iam.workloadIdentityUser"

Azure — Managed Identity Federation

# Federated Identity Credentials
az ad app federated-credential create \
  --id <app-id> \
  --parameters '{
    "name": "GitHubActions",
    "issuer": "https://token.actions.githubusercontent.com",
    "subject": "repo:my-org/my-repo:environment:prod",
    "audiences": ["api://AzureADTokenExchange"]
  }'

5. Outils d'Analyse IAM

Outil	AWS	GCP	Azure	Description
PMapper	✓	✗	✗	Analyse des chemins de privesc IAM
Principal Mapper	✓	✗	✗	Visualisation des permissions
AzureHound	✗	✗	✓	BloodHound pour Azure AD
ROADtools	✗	✗	✓	Azure AD investigation
gcp_iam_analyzer	✗	✓	✗	Analyse IAM GCP
Policy Sentry	✓	✗	✗	Analyse minimale de politique
Access Analyzer	✓	✗	✗	AWS IAM Access Analyzer
CloudSploit	✓	✓	✓	Permissions checking
Prowler	✓	✓	✓	IAM checks CIS
ScoutSuite	✓	✓	✓	IAM audit

Ressources

AWS IAM Documentation: https://docs.aws.amazon.com/IAM/latest/UserGuide/
GCP IAM Documentation: https://cloud.google.com/iam/docs
Azure RBAC Documentation: https://docs.microsoft.com/en-us/azure/role-based-access-control/
IAM Privesc AWS: https://rhinosecuritylabs.com/aws/aws-iam-privilege-escalation/
IAM Privesc GCP: https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/
IAM Privesc Azure: https://rhinosecuritylabs.com/azure/azure-privilege-escalation/
PMapper: https://github.com/nccgroup/PMapper
AzureHound: https://github.com/BloodHoundAD/AzureHound
ROADtools: https://github.com/dirkjanm/ROADtools
Policy Sentry: https://github.com/salesforce/policy_sentry