cis-aws-foundations-2.14

Ensure IAM policies that allow full ":" administrative privileges are not attached

Description

IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered standard security advice to grant least privilege, granting only the permissions required to perform a task. Determine what users need to do, and then craft policies for them that allow the users to perform only those tasks, instead of granting full administrative privileges.

Rationale

It is more secure to start with a minimal set of permissions and grant additional permissions as necessary, rather than starting with overly permissive access and attempting to restrict it later.

Providing full administrative privileges instead of restricting access to the minimum required exposes resources to potentially unintended or malicious actions.

IAM policies that contain a statement with "Effect": "Allow" and "Action": "*" over "Resource": "*" should be removed.

Impact

Policies granting full administrative privileges significantly increase the risk of unauthorized or unintended actions, potentially resulting in complete account compromise.

Audit Procedure

Using AWS CLI

1. Run the following to get a list of IAM policies:

aws iam list-policies --only-attached --output text

2. For each policy returned, evaluate the default policy version to determine if it allows full administrative privileges (":"). The default version represents the effective permissions applied.

3. Alternatively, the following command can be used to identify all attached policies that allow full administrative privileges and list associated entities:

policies=$(aws iam list-policies --scope All --only-attached --query 'Policies[*].Arn' --output text)

for arn in $policies; do
  version=$(aws iam get-policy --policy-arn "$arn" --query 'Policy.DefaultVersionId' --output text)

  is_admin=$(aws iam get-policy-version --policy-arn "$arn" --version-id "$version" --query 'PolicyVersion.Document' | jq -r '
    .Statement |
    (if type == "array" then .[] else . end) |
    select(.Effect == "Allow") |
    select(
        (.Action | if type == "array" then .[] else . end == "*") and
        (.Resource | if type == "array" then .[] else . end == "*")
    )
  ')

  if [ ! -z "$is_admin" ]; then
    echo "-------------------------------------------------------------"
    echo "ADMIN POLICY FOUND: $arn"
    echo "ATTACHED ENTITIES:"
    aws iam list-entities-for-policy --policy-arn "$arn" --query '{Users: PolicyUsers[*].UserName, Roles: PolicyRoles[*].RoleName, Groups: PolicyGroups[*].GroupName}' --output yaml
  fi
done

4. In the output, no policy should contain a statement with:

• "Effect": "Allow"
• "Action": "*"
• "Resource": "*"

Using AWS Console

1. Sign in to the AWS Management Console and open the IAM console
2. In the navigation pane, click Policies
3. Search for the policy identified in the audit step
4. Select the policy
5. Choose Detach
6. Detach the policy from all Users, Groups, and Roles
7. Delete the policy if it is no longer required

Expected Result

No attached IAM policies should contain a statement with "Effect": "Allow", "Action": "*", and "Resource": "*" simultaneously.

Remediation

Using AWS Console

1. Sign in to the AWS Management Console and open the IAM console
2. In the navigation pane, click Policies
3. Search for the policy identified in the audit step
4. Select the policy
5. Choose Detach
6. Detach the policy from all Users, Groups, and Roles
7. Delete the policy if it is no longer required

Using AWS CLI

1. List all entities attached to the policy:

aws iam list-entities-for-policy --policy-arn <policy_arn>

2. Detach from users:

aws iam detach-user-policy --user-name <iam_user> --policy-arn <policy_arn>

3. Detach from groups:

aws iam detach-group-policy --group-name <iam_group> --policy-arn <policy_arn>

4. Detach from roles:

aws iam detach-role-policy --role-name <iam_role> --policy-arn <policy_arn>

Default Value

By default, AWS allows the creation and attachment of IAM policies that grant full administrative privileges (i.e., "Effect": "Allow", "Action": "*", "Resource": "*"). No restriction exists unless enforced through organizational policy or Service Control Policies (SCPs).

References

1. https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html
2. https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html
3. CCE-78912-3
4. https://docs.aws.amazon.com/cli/latest/reference/iam/index.html#cli-aws-iam

CIS Controls

MITRE ATT&CK Mappings

Profile

Level 1 | Automated