Ensure that customer managed IAM policy does not grant full administrative rights

Risk Level: High
Cloud Entity: AWS Managed Policy
CloudGuard Rule ID: D9.CFT.IAM.16
Covered by Spectral: Yes
Category: Security, Identity, & Compliance

GSL LOGIC

AWS_IAM_ManagedPolicy should not have PolicyDocument.Statement contain-any [ Effect='Allow' and Action='*' and Resource='*' ]

REMEDIATION

From CFT
Set AWS::IAM::ManagedPolicy Actions and Resources attributes to limited subset, e.g Actions: ['s3:Create*']

References

1. https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-edit.html#edit-managed-policy-console
2. https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html

AWS Managed Policy

AWS managed policies are designed to provide permissions for many common use cases. Full access AWS managed policies such as AmazonDynamoDBFullAccess and IAMFullAccess define permissions for service administrators by granting full access to a service. Power-user AWS managed policies such as AWSCodeCommitPowerUser and AWSKeyManagementServicePowerUser are designed for power users. Partial-access AWS managed policies such as AmazonMobileAnalyticsWriteOnlyAccess and AmazonEC2ReadOnlyAccess provide specific levels of access to AWS services without allowing permissions management access level permissions. AWS managed policies make it easier for you to assign appropriate permissions to users, groups, and roles than if you had to write the policies yourself.

Compliance Frameworks

• AWS CloudFormation ruleset