Minimize Cluster Access To Read-Only For Amazon ECR

#!/usr/bin/env bash
# Report ECR-related IAM permissions used by an EKS cluster's nodes.
# Run on: any machine with awscli, jq, and kubectl configured for the target cluster/account.

set -euo pipefail

REQUIRED_ACTIONS=(
  "ecr:BatchCheckLayerAvailability"
  "ecr:BatchGetImage"
  "ecr:GetDownloadUrlForLayer"
  "ecr:GetAuthorizationToken"
)

echo "== Discovering node IAM roles from Kubernetes nodes =="

# Try IRSA-style IAM roles for service accounts used by nodes (e.g., managed nodegroups)
echo
echo "Kubernetes nodes and their IAM roles (if discoverable):"
kubectl get nodes -o json | jq -r '
  .items[]
  | {
      name: .metadata.name,
      sa: .spec.providerID,
      labels: .metadata.labels
    }
' 2>/dev/null || echo "Warning: could not parse node IAM roles from providerID; will fall back to EC2 instance roles."

# Fallback: use AWS APIs to list Auto Scaling Groups / Launch Templates / NodeInstanceRoles

echo
echo "== Discovering node instance IAM roles via AWS APIs =="

ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
REGION=$(aws configure get region)
echo "Using AWS account: $ACCOUNT_ID  region: $REGION"
echo

# List EKS clusters in this account/region
echo "EKS clusters in this region:"
aws eks list-clusters --region "$REGION" --output text || true
echo

# Get all EC2 instances that are part of this cluster (using the kubernetes.io/cluster/* tag)
echo "EC2 instances that appear to be EKS worker nodes:"
aws ec2 describe-instances \
  --filters "Name=tag-key,Values=kubernetes.io/cluster/*" "Name=instance-state-name,Values=running" \
  --query 'Reservations[].Instances[].[InstanceId, IamInstanceProfile.Arn, Tags]' \
  --output json | jq -r '
    .[]? | @tsv
  ' || true
echo

# Collect all distinct instance profile ARNs from running EKS worker nodes
PROFILE_ARNS=$(aws ec2 describe-instances \
  --filters "Name=tag-key,Values=kubernetes.io/cluster/*" "Name=instance-state-name,Values=running" \
  --query 'Reservations[].Instances[].IamInstanceProfile.Arn' \
  --output text | tr '\t' '\n' | sort -u)

if [ -z "$PROFILE_ARNS" ]; then
  echo "No IAM instance profiles found for running EKS worker nodes in this region."
  exit 0
fi

echo "== Evaluating IAM policies attached to worker node instance roles =="
echo

for PROFILE_ARN in $PROFILE_ARNS; do
  PROFILE_NAME=$(basename "$PROFILE_ARN")

  ROLE_ARN=$(aws iam get-instance-profile \
    --instance-profile-name "$PROFILE_NAME" \
    --query 'InstanceProfile.Roles[0].Arn' \
    --output text 2>/dev/null || echo "")

  if [ -z "$ROLE_ARN" ] || [ "$ROLE_ARN" = "None" ]; then
    echo "Instance profile $PROFILE_NAME has no attached role; skipping."
    continue
  fi

  ROLE_NAME=$(basename "$ROLE_ARN")
  echo "----"
  echo "Instance profile: $PROFILE_NAME"
  echo "Node IAM role:    $ROLE_NAME"

  # List all policies (inline + attached) for the role
  echo "Attached managed policies:"
  aws iam list-attached-role-policies \
    --role-name "$ROLE_NAME" \
    --query 'AttachedPolicies[].PolicyArn' \
    --output text || true

  echo
  echo "Inline policies:"
  aws iam list-role-policies \
    --role-name "$ROLE_NAME" \
    --output text || true
  echo

  # Build a list of policy documents (inline + managed) and check for ECR actions
  echo "ECR-related permissions for role $ROLE_NAME:"
  TMP_FILE=$(mktemp)

  # Inline policies
  INLINE_POLICY_NAMES=$(aws iam list-role-policies --role-name "$ROLE_NAME" --query 'PolicyNames' --output text)
  for PNAME in $INLINE_POLICY_NAMES; do
    aws iam get-role-policy \
      --role-name "$ROLE_NAME" \
      --policy-name "$PNAME" \
      --query 'PolicyDocument' \
      --output json >> "$TMP_FILE"
  done

  # Managed policies
  MANAGED_POLICY_ARNS=$(aws iam list-attached-role-policies \
    --role-name "$ROLE_NAME" \
    --query 'AttachedPolicies[].PolicyArn' \
    --output text)

  for PARN in $MANAGED_POLICY_ARNS; do
    VERSION_ID=$(aws iam get-policy \
      --policy-arn "$PARN" \
      --query 'Policy.DefaultVersionId' \
      --output text)
    aws iam get-policy-version \
      --policy-arn "$PARN" \
      --version-id "$VERSION_ID" \
      --query 'PolicyVersion.Document' \
      --output json >> "$TMP_FILE"
  done

  if [ ! -s "$TMP_FILE" ]; then
    echo "  No policy documents found for role $ROLE_NAME."
    rm -f "$TMP_FILE"
    continue
  fi

  echo "  All ECR-related actions found:"
  jq -r '
    (.Statement // []) as $s
    | if (type=="object" and .Statement) then [.Statement] else $s end
  ' "$TMP_FILE" 2>/dev/null | jq -r '
    .[]? 
    | select(.Action != null)
    | .Effect as $effect
    | (if (.Action|type)=="string" then [.Action] else .Action end) as $acts
    | $acts[]
    | select(test("^ecr:"; "i"))
    | "\($effect)\t\(.)"
  ' | sort -u | awk '{print "   - "$0}' || echo "   - none"

  echo
  echo "  REQUIRED minimal ECR actions (per benchmark):"
  for a in "${REQUIRED_ACTIONS[@]}"; do
    echo "   - $a"
  done

  echo
  echo "  EXTRA/WIDER ECR permissions (POTENTIAL PROBLEM):"
  # Anything ecr:* that is NOT in the required list is suspicious
  jq -r '
    (.Statement // []) as $s
    | if (type=="object" and .Statement) then [.Statement] else $s end
  ' "$TMP_FILE" 2>/dev/null | jq -r '
    .[]? 
    | select(.Action != null)
    | .Effect as $effect
    | (if (.Action|type)=="string" then [.Action] else .Action end) as $acts
    | $acts[]
    | select(test("^ecr:"; "i"))
    | "\($effect)\t\(.)"
  ' | sort -u | while read -r EFFECT ACTION; do
      IS_REQUIRED=false
      for req in "${REQUIRED_ACTIONS[@]}"; do
        if [ "$ACTION" = "$req" ]; then
          IS_REQUIRED=true
          break
        fi
      done
      if [ "$IS_REQUIRED" = false ]; then
        echo "   - $EFFECT $ACTION"
      fi
    done

  rm -f "$TMP_FILE"
  echo
done

echo "== Interpretation =="
cat <<'EOF'
Any node IAM role that:
  - is missing one of the required actions:
      ecr:BatchCheckLayerAvailability
      ecr:BatchGetImage
      ecr:GetDownloadUrlForLayer
      ecr:GetAuthorizationToken
    may fail to pull images from ECR, and requires remediation to ADD those read-only actions.

  - shows EXTRA/WIDER ECR permissions (for example ecr:*, ecr:PutImage, ecr:DeleteRepository, etc.)
    under the "EXTRA/WIDER ECR permissions (POTENTIAL PROBLEM)" section is OVER-PRIVILEGED and
    should be manually reviewed. The goal is to restrict the node role to ONLY the four
    read-only actions above, unless there is a strong, documented business need.
EOF