OpenParable
Skip to content
← Back to skills

Cis AWS Database 4.1

DevOps & Security
cis-aws-database-4.1

Cis AWS Database 4.1 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure AWS Identity and Access Management (IAM) is in use

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/AWS/CIS_AWS_Database_Services_Benchmark_v2.0.0/cis-aws-database-4.1/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-aws-database-4-1, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

4.1 Ensure AWS Identity and Access Management (IAM) is in use

Description

AWS Identity and Access Management (IAM) lets you securely control your users' access to AWS services and resources. To manage access control for Amazon DynamoDB, you can create IAM policies that control access to tables and data.

Rationale

IAM policies help you control and maintain access to Amazon DynamoDB as needed.

Impact

N/A

Audit Procedure

Using AWS Console

  1. Open IAM Console

  2. Navigate to Policies

    • In the IAM console, in the navigation pane, choose Policies.

  3. Create Policy

    • Choose Create policy.
    • You will be taken to the Create policy page.

  4. Choose Service

    • Click on Choose a service.
    • Type DynamoDB in the search box and select it.

  5. Configure Actions

    • Under the Actions section, select the actions you want to allow the user to perform.
    • For instance, you can select Read to allow read actions like GetItem, Scan, Query, etc.

  6. Set Resources

    • Under the Resources section, you can specify which tables this policy applies to.
    • You can choose "All resources" or specify the ARN (Amazon Resource Name) of specific tables.

  7. Review Policy

    • Click on Review policy.
    • Give your policy a name and description.
    • Then click Create policy.
    • Now, you have an IAM policy.

  8. Attach Policy

    • Navigate to the Users, Groups, or Roles section in the IAM console.
    • Choose an existing user, group, or role, or create a new one.
    • Once you've selected a user, group, or role, click Add permissions.
    • Choose Attach existing policies directly.
    • Search for your created policy, select it, and click Attach policy.
    • With these steps, you have attached an IAM policy that controls access to DynamoDB resources.

Expected Result

IAM policies are in place that control access to DynamoDB tables and data, following the principle of least privilege.

Remediation

Using AWS Console

Follow the same steps as the audit procedure to create and attach IAM policies for DynamoDB access control.

Default Value

By default, no IAM policies are created for DynamoDB access. Users with AWS account root credentials have full access.

References

  1. https://aws.amazon.com/products/databases/

CIS Controls

Controls VersionControlIG 1IG 2IG 3
v83.3 Configure Data Access Control Listsxxx
v714.6 Protect Information through Access Control Listsxxx

Profile

Level 1 | Manual