Risk Level: Critical
Cloud Entity: IAM Policy
CloudGuard Rule ID: D9.AWS.IAM.71
Covered by Spectral: No
Category: Security, Identity, & Compliance

GSL LOGIC

IamPolicy where name regexMatch /AWS/ should not have document.Statement contain [ Effect='Allow' and (Action='S3:*' or Action='s3:getObject') ]

REMEDIATION

Note: AWS managed policies cannot be deleted.

From Portal

Go to 'IAM'
In the menu, under 'Access management', choose 'Policies'
For each incompliant policy, make sure there are no IAM entities attached to it:
Choose the incompliant policy
Under 'Policy usage', detach any IAM entity attached to it

From Command Line
To remove the specified managed policy from a specified user, run:

aws iam detach-user-policy --user-name USER-NAME --policy-arn POLICY-ARN

To remove the specified managed policy from a specified IAM group, run:

aws iam detach-group-policy --group-name GROUP-NAME --policy-arn POLICY-ARN

To remove the specified managed policy from a specified role, run:

aws iam detach-role-policy --role-name ROLE-NAME --policy-arn POLICY-ARN

References

IAM Policy

You manage access in AWS by creating policies and attaching them to IAM identities or AWS resources. A policy is an object in AWS that, when associated with an entity or resource, defines their permissions. AWS evaluates these policies when a principal, such as a user, makes a request. Permissions in the policies determine whether the request is allowed or denied. Most policies are stored in AWS as JSON documents.

Compliance Frameworks

AWS CSA CCM v.4.0.1
AWS CloudGuard Best Practices
AWS CloudGuard S3 Bucket Security
AWS CloudGuard SOC2 based on AICPA TSC 2017
AWS HITRUST v11.0.0
AWS ISO27001:2022
AWS LGPD regulation
AWS MITRE ATT&CK Framework v11.3
AWS NIST 800-53 Rev 5
CloudGuard AWS All Rules Ruleset
CloudGuard AWS Default Ruleset