{
  "_comment": [
    "============================================================",
    "VULNERABLE IAM Configuration — CTF Challenge Resource",
    "============================================================",
    "This configuration contains INTENTIONAL security weaknesses",
    "for educational / CTF use only. DO NOT deploy in production.",
    "============================================================"
  ],

  "UserName": "deploy-user",
  "AttachedManagedPolicies": [
    {
      "PolicyName": "AmazonEC2FullAccess",
      "PolicyArn": "arn:aws:iam::aws:policy/AmazonEC2FullAccess"
    }
  ],

  "InlinePolicies": [
    {
      "PolicyName": "DeployUserInlinePolicy",
      "PolicyDocument": {
        "Version": "2012-10-17",
        "Statement": [
          {
            "_finding": "Wildcard S3 access — read/write/delete on ALL buckets",
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "*"
          },
          {
            "_finding": "Full EC2 access on all resources — can launch, terminate, modify any instance",
            "Effect": "Allow",
            "Action": "ec2:*",
            "Resource": "*"
          },
          {
            "_finding": "iam:PassRole with wildcard resource — can pass ANY role to ANY service",
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "*"
          },
          {
            "_finding": "iam:CreateRole and AttachRolePolicy — can create admin roles",
            "Effect": "Allow",
            "Action": [
              "iam:CreateRole",
              "iam:AttachRolePolicy",
              "iam:PutRolePolicy",
              "iam:CreatePolicy"
            ],
            "Resource": "*"
          },
          {
            "_finding": "STS AssumeRole with no restrictions — can assume ANY role in the account",
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "*"
          },
          {
            "_finding": "Lambda full access — can create/invoke functions with any attached role",
            "Effect": "Allow",
            "Action": "lambda:*",
            "Resource": "*"
          },
          {
            "_finding": "Full DynamoDB access — can read/write/delete any table",
            "Effect": "Allow",
            "Action": "dynamodb:*",
            "Resource": "*"
          },
          {
            "_finding": "Full Secrets Manager access — can read all secrets",
            "Effect": "Allow",
            "Action": [
              "secretsmanager:GetSecretValue",
              "secretsmanager:ListSecrets",
              "secretsmanager:DescribeSecret",
              "secretsmanager:CreateSecret",
              "secretsmanager:DeleteSecret"
            ],
            "Resource": "*"
          },
          {
            "_finding": "CloudFormation full access — can deploy/delete entire stacks",
            "Effect": "Allow",
            "Action": "cloudformation:*",
            "Resource": "*"
          },
          {
            "_finding": "Full CloudWatch Logs access — can read and delete logs (cover tracks)",
            "Effect": "Allow",
            "Action": [
              "logs:*"
            ],
            "Resource": "*"
          }
        ]
      }
    },
    {
      "PolicyName": "BackupPolicy",
      "PolicyDocument": {
        "Version": "2012-10-17",
        "Statement": [
          {
            "_finding": "Allows copying snapshots to external accounts — data exfiltration path",
            "Effect": "Allow",
            "Action": [
              "ec2:CopySnapshot",
              "ec2:ModifySnapshotAttribute",
              "ec2:CreateSnapshot",
              "rds:CopyDBSnapshot",
              "rds:ModifyDBSnapshotAttribute"
            ],
            "Resource": "*"
          }
        ]
      }
    }
  ],

  "AccessKeys": [
    {
      "_finding": "Multiple active access keys — increases credential exposure risk",
      "AccessKeyId": "AKIAIOSFODNN7EXAMPLE",
      "Status": "Active",
      "CreateDate": "2024-01-15T10:30:00Z"
    },
    {
      "AccessKeyId": "AKIAI44QH8DHBEXAMPLE",
      "Status": "Active",
      "CreateDate": "2024-08-22T14:15:00Z"
    }
  ],

  "MFADevices": [],

  "SummaryOfFindings": {
    "_note": "This section enumerates the security issues for CTF scoring",
    "issues": [
      "CRITICAL: Inline policy attached directly to IAM user (not a role)",
      "CRITICAL: s3:* with Resource:* — full access to all S3 buckets",
      "CRITICAL: ec2:* with Resource:* — full access to all EC2 instances",
      "CRITICAL: iam:PassRole with Resource:* — can escalate to any role",
      "CRITICAL: iam:CreateRole + AttachRolePolicy — can create admin roles",
      "CRITICAL: sts:AssumeRole with Resource:* — can assume any role",
      "CRITICAL: secretsmanager:GetSecretValue on * — can read all secrets",
      "HIGH: lambda:* — can create functions with arbitrary role permissions",
      "HIGH: CopySnapshot + ModifySnapshotAttribute — data exfiltration path",
      "HIGH: logs:* — can delete CloudWatch logs to cover tracks",
      "HIGH: No MFA configured on IAM user",
      "HIGH: Multiple active access keys",
      "MEDIUM: No Condition blocks (e.g., aws:SourceIp, aws:MultiFactorAuthPresent)",
      "MEDIUM: No resource-level restrictions (all statements use Resource:*)",
      "MEDIUM: Managed policy AmazonEC2FullAccess also attached (redundant + broad)"
    ]
  }
}