Crash while scanning principals that use deprecated permission policies about pmapper

[rdegraaf]

For the moment, I'm working around the issue. In principalmapper/graphing/gathering.py, I replaced

    for p in u['AttachedManagedPolicies']:
        user_policies.append(_get_policy_by_arn_or_raise(p['PolicyArn'], result['policies']))

with

    for p in u['AttachedManagedPolicies']:
        try:
            user_policies.append(_get_policy_by_arn_or_raise(p['PolicyArn'], result['policies']))
        except ValueError as e:
            logger.warning('Unable to retrieve attached Policy {} for User {}.'.format(p['PolicyArn'], u['Arn']))

and

    for p in r['AttachedManagedPolicies']:
        role_policies.append(_get_policy_by_arn_or_raise(p['PolicyArn'], result['policies']))

with

    for p in r['AttachedManagedPolicies']:
        try:
            role_policies.append(_get_policy_by_arn_or_raise(p['PolicyArn'], result['policies']))
        except ValueError as e:
            logger.warning('Unable to retrieve attached Policy {} for Role {}.'.format(p['PolicyArn'], r['Arn']))

[CoryFaris-NCC]

The same issue is present for the deprecated policy arn:aws:iam::aws:policy/service-role/AWSConfigRole.
https://aws.amazon.com/blogs/mt/service-notice-upcoming-changes-required-for-aws-config/

2023-10-05 16:47:12-0400 | Sorting users, roles, groups, policies, and their relationships.
Traceback (most recent call last):
  File "/home/k25044/pmapper/bin/pmapper", line 8, in <module>
    sys.exit(main())
  File "/home/k25044/pmapper/lib/python3.10/site-packages/principalmapper/__main__.py", line 145, in main
    return graph_cli.process_arguments(parsed_args)
  File "/home/k25044/pmapper/lib/python3.10/site-packages/principalmapper/graphing/graph_cli.py", line 179, in process_arguments
    graph = graph_actions.create_new_graph(session, service_list, parsed_args.include_regions,
  File "/home/k25044/pmapper/lib/python3.10/site-packages/principalmapper/graphing/graph_actions.py", line 39, in create_new_graph
    return gathering.create_graph(session, service_list, region_allow_list, region_deny_list, scps, client_args_map)
  File "/home/k25044/pmapper/lib/python3.10/site-packages/principalmapper/graphing/gathering.py", line 75, in create_graph
    results = get_nodes_groups_and_policies(iamclient)
  File "/home/k25044/pmapper/lib/python3.10/site-packages/principalmapper/graphing/gathering.py", line 226, in get_nodes_groups_and_policies
    role_policies.append(_get_policy_by_arn_or_raise(p['PolicyArn'], result['policies']))
  File "/home/k25044/pmapper/lib/python3.10/site-packages/principalmapper/graphing/gathering.py", line 1005, in _get_policy_by_arn_or_raise
    raise ValueError('Could not locate policy {}.'.format(arn))
ValueError: Could not locate policy arn:aws:iam::aws:policy/service-role/AWSConfigRole.

[rdegraaf]

Related: nccgroup/ScoutSuite#1573