You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Sep 18, 2023. It is now read-only.
Since we're already looking at all IAM policies that are used for federated login, we might as well make sure there aren't any dangerous conditions present for example
a policy which has no amr check thereby allowing every user that can authenticate with Auth0
a policy which uses a federated identity provider other than auth0
a policy which through amr checks allows all users (e.g. the policy has a StringNotEquals instead of a StringEquals on an amr value)
etc
When we detect these risky situations we should alert to MozDef or something.
Since we're already looking at all IAM policies that are used for federated login, we might as well make sure there aren't any dangerous conditions present for example
amr
check thereby allowing every user that can authenticate with Auth0amr
checks allows all users (e.g. the policy has a StringNotEquals instead of a StringEquals on anamr
value)etc
When we detect these risky situations we should alert to MozDef or something.
Original Jira ticket IAM-140
The text was updated successfully, but these errors were encountered: