I audited Prowler's 48 IAM checks against a linter I built, and found a real gap
A few weeks ago I was prepping for a Cloud Security Engineer interview and built a small exercise: a Python function that scans an AWS IAM policy document and flags a few classic risks: wildcard actions, wildcard resources, unrestricted iam:PassRole . It was meant to be throwaway interview prep. It didn't stay throwaway. I kept adding rules, and it turned into iam-lint , a real, tested,…
A reporter examined 48 IAM checks by Prowler and discovered a significant discrepancy, as they constructed a Python function to scan AWS IAM policy documents and identify common risks. The reporter built the iam-lint tool, which scans for issues such as wildcard actions, wildcard resources, and unrestricted iam:PassRole. The reporter then compared the 48 checks against the 7 rules in the iam-lint tool.
The reporter found a gap between the two tools - MISSING_MFA_CONDITION - that is not covered by Prowler's checks. This distinction is important as it ensures that policies requiring MFA for sensitive actions are properly enforced. The reporter filed a request to add the new check to Prowler's list, following their guidelines and confirming the gap did not already exist in Prowler's checks.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
