aws/variants/add: - uid: mondoo-incident-response-aws-iam-administrat…

…or-access-group Signed-off-by: Manuel Weber <[email protected]>
mondoohq · Jan 18, 2024 · c81d055 · c81d055
1 parent 9afbf65
commit c81d055
Showing 1 changed file with 18 additions and 1 deletion.
diff --git a/core/mondoo-aws-incident-response.mql.yaml b/core/mondoo-aws-incident-response.mql.yaml
@@ -130,7 +130,24 @@ packs:
             loginProfile
             groups
           }
-
+      - uid: mondoo-incident-response-aws-iam-administrator-access-group
+        filters: |
+          asset.platform == "aws.iam.group"
+          aws.iam.attachedPolicies
+            .where(arn == "arn:aws:iam::aws:policy/AdministratorAccess")
+            .any(attachedGroups
+              .contains(
+                arn.in(asset.ids)
+              )
+            )
+        mql: |
+          aws.iam.group {
+            arn
+            name
+            createDate
+            id
+            usernames
+          }
 
 
       - uid: mondoo-incident-response-aws-iam-full-access