Guides

Ensure that there is no wildcard resource in an inline IAM user policy

IAM user policy should be setup in such a way that it follows the least privilege principle. Having wildcard in an resource means that specified actions are allowed on all the resources.

Suggest Edits

Risk Level: High
Cloud Entity: IAM User
CloudGuard Rule ID: D9.CFT.IAM.27
Covered by Spectral: No
Category: Security, Identity, & Compliance

GSL LOGIC

AWS_IAM_User should not have Policies contain-any [ PolicyDocument.Statement contain-any [ Effect='Allow' and Resource='*' ] ]

REMEDIATION

From CFT
Set AWS::IAM::User Policies.PolicyDocument.Statement.Resource to a specific set of resources.

References

  1. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-user.html
  2. https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_resource.html

IAM User

An IAM user is an entity that you create in AWS to represent the person or service that uses it to interact with AWS. A user in AWS consists of a name and credentials.

Compliance Frameworks

  • AWS CloudFormation ruleset

Updated over 1 year ago