Guides

Ensure AWS IAM policies allow only the required privileges for each role

IAM policies are the means by which privileges are granted to users, groups, or roles. IAM Policies should follow the standard principle of least privilege - granting only the permissions required to perform a task. It is recommended to begin with a minimum set of permissions and grant additional permissions as necessary, instead of allowing full administrative privileges.

Suggest Edits

Risk Level: Low
Cloud Entity: IAM Policy
CloudGuard Rule ID: D9.AWS.IAM.52
Covered by Spectral: No
Category: Security, Identity, & Compliance

GSL LOGIC

IamPolicy where arn!='arn:aws:iam::aws:policy/AdministratorAccess' should not have document.Statement contain-any [ $ with [ Effect='Allow' and Action='*' ] ]

REMEDIATION

From Portal:
Perform the following to detach the policy that has excessive administrative privileges:

  1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
  2. In the navigation pane, click Policies and then search for the policy name.
  3. Select the policy that needs to be deleted.
  4. In the policy action menu, select first Detach.
  5. Select all Users, Groups, Roles that have this policy attached.
  6. Click Detach Policy.
  7. In the policy action menu, select Detach.

From Command Line:

  1. Lists all IAM users, groups, and roles that the specified managed policy is attached to, identify and note any excessive privileges.
aws iam list-entities-for-policy --policy-arn policy_arn
  1. Detach the policy from all IAM Users:
aws iam detach-user-policy --user-name iam_user --policy-arn policy_arn
  1. Detach the policy from all IAM Groups:
aws iam detach-group-policy --group-name iam_group --policy-arn policy_arn
  1. Detach the policy from all IAM Roles:
aws iam detach-role-policy --role-name iam_role --policy-arn policy_arn

References:

  1. https://docs.amazonaws.cn/en_us/IAM/latest/UserGuide/best-practices.html#grant-least-privilege
  2. https://docs.amazonaws.cn/en_us/IAM/latest/UserGuide/access_policies.html
  3. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/detach-group-policy.html
  4. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/detach-role-policy.html
  5. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/detach-user-policy.html
  6. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-entities-for-policy.html

IAM Policy

You manage access in AWS by creating policies and attaching them to IAM identities or AWS resources. A policy is an object in AWS that, when associated with an entity or resource, defines their permissions. AWS evaluates these policies when a principal, such as a user, makes a request. Permissions in the policies determine whether the request is allowed or denied. Most policies are stored in AWS as JSON documents.

Compliance Frameworks

  • AWS CSA CCM v.4.0.1
  • AWS CloudGuard Best Practices
  • AWS CloudGuard SOC2 based on AICPA TSC 2017
  • AWS CloudGuard Well Architected Framework
  • AWS HITRUST
  • AWS HITRUST v11.0.0
  • AWS ISO27001:2022
  • AWS ITSG-33
  • AWS MAS TRM Framework
  • AWS MITRE ATT&CK Framework v10
  • AWS MITRE ATT&CK Framework v11.3
  • AWS NIST 800-53 Rev 5
  • AWS PCI-DSS 4.0
  • CloudGuard AWS All Rules Ruleset

Updated about 1 year ago