cis-aws-foundations-2.15

Ensure a support role has been created to manage incidents with AWS Support

Description

AWS provides a Support Center that can be used for incident notification and response, as well as technical support and customer service. Create an IAM role with the appropriate policy assigned to allow authorized users to manage incidents with AWS Support.

Rationale

Following the principle of least privilege, an IAM role should be used with a scoped policy to allow access to AWS Support. This ensures only authorized users can manage support cases without requiring broad administrative access.

Impact

Without a dedicated support role, access to AWS Support may require overly permissive roles, increasing the risk of excessive access and reducing separation of duties.

Audit Procedure

Using AWS Console

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam
2. In the left navigation pane, under Access management, select Policies
3. In the policy search field, enter AWSSupportAccess
4. Select the policy
5. Click the Entities attached tab
6. Ensure at least one IAM Role is attached

Using AWS CLI

1. Identify the AWS managed support policy:

aws iam list-policies --query "Policies[?PolicyName=='AWSSupportAccess'].Arn" --output text

2. Check if it is attached to any roles:

aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess

3. Ensure that at least one role is listed under PolicyRoles

Expected Result

At least one IAM role should be attached to the AWSSupportAccess policy. The policy ARN is arn:aws:iam::aws:policy/AWSSupportAccess.

Remediation

Using AWS Console

1. Sign in to the AWS Management Console and open the IAM console
2. Navigate to Roles
3. Click Create role
4. Configure the trusted entity (e.g., your AWS account or identity provider)
5. Attach the AWSSupportAccess policy
6. Complete role creation
7. Assign the role to appropriate users or groups

Using AWS CLI

1. Create a trust policy (example):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<account-id>:root"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

2. Create the role:

aws iam create-role --role-name <role-name> --assume-role-policy-document file://trust-policy.json

3. Attach the AWS Support policy:

aws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess --role-name <role-name>

Default Value

By default, AWS does not create a dedicated support role. IAM users and roles with sufficient permissions (e.g., AdministratorAccess) can access the Support Center unless a specific role with the AWSSupportAccess policy is created.

References

1. https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html
2. https://aws.amazon.com/premiumsupport/pricing/
3. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-policies.html
4. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/attach-role-policy.html
5. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-entities-for-policy.html

Additional Information

• The AWSSupportAccess policy is a global AWS managed policy with ARN: arn:aws:iam::aws:policy/AWSSupportAccess
• Avoid granting support access through broad policies like AdministratorAccess
• Assign the support role only to users who require it to maintain separation of duties

CIS Controls

Profile

Level 1 | Automated