# serverless-plugin-iam-checker > A serverless plugin to check IAM policies for security compliance Latest version **1.0.8** (published 2021-04-10) · MIT license · 0 weekly downloads ## Install ```sh npm install serverless-plugin-iam-checker pnpm add serverless-plugin-iam-checker yarn add serverless-plugin-iam-checker bun add serverless-plugin-iam-checker ``` ## Health **Score 25/100 (F)** — status: abandoned. Positive: has types; no vulnerabilities; high quality score. Warnings: low downloads; no esm support. Negative: abandoned; low maintenance score. ## Facts | | | |---|---| | Version | 1.0.8 | | Published | 2021-04-10 | | First published | 2018-08-28 | | Weekly downloads | 0 | | License | MIT | | TypeScript types | bundled | | Module format | CommonJS | | Dependencies | 0 | | Unpacked size | 47.5 KB | | Known vulnerabilities | 0 | | Install scripts | no | | Author | From Phillip with ♥ | | Maintainers | philmanwaring | | Keywords | serverless, plugin, iam, security | ## Links - npm: https://www.npmjs.com/package/serverless-plugin-iam-checker - Repository: https://github.com/manwaring/serverless-plugin-iam-checker - Issues: https://github.com/manwaring/serverless-plugin-iam-checker - npm.io page: https://npm.io/package/serverless-plugin-iam-checker ## Recent versions - 1.0.8 (latest) — 2021-04-10 - 1.0.7 — 2020-09-12 - 1.0.6 — 2020-08-17 - 1.0.5 — 2020-05-09 - 1.0.4 — 2020-05-08 - 1.0.3 — 2020-03-16 - 1.0.2 — 2020-01-13 - 1.0.1 — 2019-08-19 - 1.0.0 — 2019-08-18 - 0.0.47 — 2019-07-26 - 0.0.46 — 2019-07-14 - 0.0.45 — 2019-07-14 - 0.0.44 — 2019-01-27 - 0.0.43 — 2018-09-17 - 0.0.42 — 2018-09-13 - … 41 more at https://npm.io/package/serverless-plugin-iam-checker/versions ## README

# Serverless plugin IAM checker 1. [Overview](#overview) 1. [Installation and setup](#installation-and-setup) 1. [Rule configuration](#rule-configuration) 1. [Default rule configuration](#default-rule-configuration) 1. [Action rules](#action-rules) 1. [Resource rules](#resource-rules) 1. [Setting rules via serverless.yml](#setting-rules-via-serverless.yml) 1. [Setting rules via environment variables](#setting-rules-via-environment-variables) 1. [Detailed validation logging](#detailed-validation-logging) 1. [Examples](#examples) _Feedback appreciated! If you have an idea for how this plugin can be improved [please open an issue](https://github.com/manwaring/serverless-plugin-iam-checker/issues/new)._ # Overview This [Serverless Framework](https://github.com/serverless/serverless) plugin checks all generated IAM resources in a serverless project and validates their permission configurations for overly-permissive actions and/or resource references. If IAM resources are invalid per the configured rules then the `sls` command will fail after the `package` step, preventing the generated CloudFormation Stack from being deployed to AWS. # Installation and setup Install and save the package to `package.json` as a dev dependency: `npm i --save-dev serverless-plugin-iam-checker` Add the package to the `serverless.yml` plugins section: ```yml plugins: - serverless-plugin-iam-checker ``` By default the plugin uses a [restrictive set of rules for action and resource configuration](#default-rule-configuration). These rules can be modified using either [serverless.yml custom configuration](#setting-rules-via-serverless.yml) or [environment variables](#setting-rules-via-environment-variables). # Rule configuration Rules are configured separately for actions and resources due to resources generally having a greater need for dynamic references, while actions can almost always be constrained explicitly. If any of the action or resource rules aren't found in environment variables or the `serverless.yml` custom config section then this plugin will use the default configurations specified in the tables below. If rule values are found in both environment variables and `serverless.yml` the plugin will use the environment variable values - this is done to help ensure security compliance in build/test/deploy pipelines where developers generally don't have access to underlying environoment variables (as opposed to `serverless.yml`, which they typically have unlimited access to modify). ## Default rule configuration ```yml actions: allowWildcards: false allowWildcardOnly: false allowedPatterns: [] resources: allowWildcards: true allowWildcardOnly: false allowedPatterns: [] allowedReferences: [] ``` ## Action rules | Property | Description | Example | | ------------------- | ------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------- | | Allow wildcards | **Type**: boolean
**Effect**: can actions include wildcards
**Default**: `false` | **Config**: `false`
**Passes**: `dynamodb:PutItem`
**Fails**: `dynamodb:*` | | Allow wildcard only | **Type**: boolean
**Effect**: can actions be only wildcards
**Default**: `false` | **Config**: `true`
**Passes**: `*`
**Fails**: `dynamodb:*` | | Allowed patterns | **Type**: string array
**Effect**: actions must match a listed pattern
**Default**: `[]` | **Config**: `['dynamodb:']`
**Passes**: `dynamodb:PutItem`
**Fails**: `s3:PutObject` | ## Resource rules | Property | Description | Example | | ------------------- | ------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------- | | Allow wildcards | **Type**: boolean
**Effect**: can resources include wildcards
**Default**: `true` | **Config**: `false`
**Passes**: `arn:whatever`
**Fails**: `arn:*` | | Allow wildcard only | **Type**: boolean
**Effect**: can resources be only wildcards
**Default**: `false` | **Config**: `true`
**Passes**: `*`
**Fails**: `arn:*` | | Allowed patterns | **Type**: string array
**Effect**: resources must match a listed pattern
**Default**: `[]` | **Config**: `['arn:']`
**Passes**: `arn:whatever`
**Fails**: `whatever` | | Allowed references | **Type**: string array
**Effect**: resource references must match a listed pattern
**Default**: `[]` | **Config**: `['Ref']`
**Passes**: `{ 'Ref': 'whatever' }`
**Fails**: `{ 'Fn::Sub': 'whatever' }` | ## Setting rules via serverless.yml ```yml custom: iamChecker: # This key is used by the plugin to pull in the optional rule configuration actions: allowWildcards: false allowWildcardOnly: false allowedPatterns: - 'dynamodb:' resources: allowWildcards: true allowWildcardOnly: false allowedPatterns: - 'arn:' allowedReferences: - 'Ref' - 'Fn::Join' - 'Fn::Sub' ``` ## Setting rules via environment variables ```bash # Actions IAM_CHECKER_ACTIONS_ALLOW_WILDCARDS=false IAM_CHECKER_ACTIONS_ALLOW_WILDCARDONLY=false IAM_CHECKER_ACTIONS_ALLOWED_PATTERNS=['dynamodb:'] # Resources IAM_CHECKER_RESOURCES_ALLOW_WILDCARDS=true IAM_CHECKER_RESOURCES_ALLOW_WILDCARDONLY=false IAM_CHECKER_RESOURCES_ALLOWED_PATTERNS=['arn:'] IAM_CHECKER_RESOURCES_ALLOWED_REFERENCES=['Ref', 'Fn::Join', 'Fn::Sub'] ``` # Detailed validation logging For detailed logs about which rules have caused resources to fail validation rerun your commands with `SLS_DEBUG=*`. Output similar to this will be logged: ``` Serverless: Packaging service... Serverless: Checking IAM permissions... IamRoleLambdaExecution has the following validation errors: Wildcard-only actions are not allowed Wildcards in actions are not allowed Actions must match the following patterns: [":"] Wildcard-only resources are not allowed Resources must match the following patterns: ["arn:"] ``` # Examples There is [one working example](examples) of how this package can be used in a simple 'hello world' serverless application: 1. [Plugin with default configuration](examples/default)

--- _Source: https://npm.io/package/serverless-plugin-iam-checker · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._