Incorrect IAM permissions causing Stratus to error on detonation of aws.defense-evasion.organizations-leave about stratus-red-team HOT 4 CLOSED

PR raised here :)

from stratus-red-team.

Thanks for reporting! I can't seem to reproduce this in my AWS account:

$ stratus detonate aws.defense-evasion.organizations-leave
2024/01/04 13:54:07 Checking your authentication against AWS
2024/01/04 13:54:07 Warming up aws.defense-evasion.organizations-leave
2024/01/04 13:54:07 Applying Terraform to spin up technique prerequisites
2024/01/04 13:54:22 Attempting to leave the AWS organization (will trigger an Access Denied error)
2024/01/04 13:54:23 Got an access denied error as expected

Any idea what could be causing your issue? There's no harm adding that permission, but I'd like to understand the underlying cause if possible

from stratus-red-team.

I think this is because we assume our own role which contains session tags, then with this role we try to assume the stratus role. When you do that in AWS, the session tags are propagated from one session to the other: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining
So it will only work for us with that extra permission unfortunately

from stratus-red-team.

Merged #463, will be available shortly under v2.12.2

from stratus-red-team.