Description

An IAM User is an entity that you create in AWS. The IAM User represents the person or service that uses the IAM User to interact with AWS. The user {AwsUser} was found with permissive permissions that allows the user the ability to pass a role to a service. By passing a role to a service, a user may grant that service the ability to interact with the AWS API with the permissions of that role. By allowing a user to pass any role, an attacker may pass a role with administrative privileges to a service they control, such as an EC2 Instance or Lambda Function, and act through this service with escalated permissions.

• 

  Recommended Mitigation

  Review the user's policy and consider removing one of the following groups of actions: **iam:PassRole**, (**lambda:CreateFunction**, **lambda:InvokeFunction**), (**lambda:InvokeFunction**, **lambda:CreateEventSourceMapping**), (**glue:CreateDevEndpoint**, **glue:GetDevEndpoint**), (**cloudformation:CreateStack**, **cloudformation:DescribeStacks**), (**datapipeline:CreatePipeline**, **datapipeline:PutPipelineDefinition**, **datapipeline:ActivatePipeline**)