Guides

Ensure IAM Policy do not have Effect: 'Allow' with 'NotAction' Element

When using NotAction, you should keep in mind that actions specified in this element are the only actions in that are limited. This, in turn, means that all of the applicable actions or services that are not listed are allowed if you use the Allow effect.

Suggest Edits

Risk Level: Low
Cloud Entity: IAM Policy
CloudGuard Rule ID: D9.AWS.IAM.90
Covered by Spectral: Yes
Category: Security, Identity, & Compliance

GSL LOGIC

IamPolicy where attachmentCount >0 should not have document.Statement contain [ Effect='Allow' and NotAction ]

REMEDIATION

Note: AWS managed policies cannot be deleted.

From Portal

  1. Go to 'IAM'
  2. In the menu, under 'Access management', choose 'Policies'
  3. For each incompliant policy, make sure there are no IAM entities attached to it:
  4. Choose the incompliant policy
  5. Under 'Policy usage', detach any IAM entity attached to it

From Command Line
To remove the specified managed policy from a specified user, run:

aws iam detach-user-policy --user-name USER-NAME --policy-arn POLICY-ARN

To remove the specified managed policy from a specified IAM group, run:

aws iam detach-group-policy --group-name GROUP-NAME --policy-arn POLICY-ARN

To remove the specified managed policy from a specified role., run:

aws iam detach-role-policy --role-name ROLE-NAME --policy-arn POLICY-ARN

References

  1. https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies
  2. https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-delete.html
  3. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/detach-user-policy.html
  4. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/detach-group-policy.html
  5. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/detach-role-policy.html

IAM Policy

You manage access in AWS by creating policies and attaching them to IAM identities or AWS resources. A policy is an object in AWS that, when associated with an entity or resource, defines their permissions. AWS evaluates these policies when a principal, such as a user, makes a request. Permissions in the policies determine whether the request is allowed or denied. Most policies are stored in AWS as JSON documents.

Compliance Frameworks

  • AWS CloudGuard Best Practices
  • AWS CloudGuard SOC2 based on AICPA TSC 2017
  • AWS HITRUST v11.0.0
  • AWS ISO27001:2022
  • AWS MITRE ATT&CK Framework v11.3
  • AWS NIST 800-53 Rev 5
  • CloudGuard AWS All Rules Ruleset

Updated over 1 year ago