cis-aws-foundations-2.20

Ensure access to AWSCloudShellFullAccess is restricted

Description

AWS CloudShell is a convenient way of running CLI commands against AWS services. The managed IAM policy AWSCloudShellFullAccess provides full access to CloudShell, including file upload and download capability between a user's local system and the CloudShell environment. Within the CloudShell environment, a user has sudo permissions and can access the internet. It is therefore possible to install software and transfer data to external systems.

Rationale

Access to this policy should be restricted, as it presents a potential channel for data exfiltration by privileged users. AWS documentation provides guidance on creating more restrictive policies that limit file transfer capabilities.

Impact

Unrestricted access to CloudShell may allow users to transfer data outside the AWS environment, increasing the risk of data exfiltration and loss of sensitive information.

Audit Procedure

Using AWS Console

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam
2. In the left pane, select Policies
3. Search for and select AWSCloudShellFullAccess
4. Select the Entities attached tab
5. Ensure that no users, groups, or roles are attached

Using AWS CLI

1. Run the following command:

aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AWSCloudShellFullAccess

2. In the output, ensure the following are empty:

• PolicyUsers
• PolicyRoles
• PolicyGroups

Example:

PolicyRoles: [ ]

Expected Result

The AWSCloudShellFullAccess policy should not be attached to any users, groups, or roles. All three lists (PolicyUsers, PolicyRoles, PolicyGroups) should be empty.

Remediation

Using AWS Console

1. Open the IAM console at https://console.aws.amazon.com/iam/
2. In the left pane, select Policies
3. Search for and select AWSCloudShellFullAccess
4. Select the Entities attached tab
5. For each attached entity:

• Select the entity
• Choose Detach

Using AWS CLI

From Command Line (optional automation):

POLICY_ARN="arn:aws:iam::aws:policy/AWSCloudShellFullAccess"

# Detach from users
for u in $(aws iam list-entities-for-policy --policy-arn "$POLICY_ARN" --query "PolicyUsers[].UserName" --output text); do
  echo "Detaching from user: $u"
  aws iam detach-user-policy --user-name "$u" --policy-arn "$POLICY_ARN"
done

# Detach from roles
for r in $(aws iam list-entities-for-policy --policy-arn "$POLICY_ARN" --query "PolicyRoles[].RoleName" --output text); do
  echo "Detaching from role: $r"
  aws iam detach-role-policy --role-name "$r" --policy-arn "$POLICY_ARN"
done

# Detach from groups
for g in $(aws iam list-entities-for-policy --policy-arn "$POLICY_ARN" --query "PolicyGroups[].GroupName" --output text); do
  echo "Detaching from group: $g"
  aws iam detach-group-policy --group-name "$g" --policy-arn "$POLICY_ARN"
done

Default Value

By default, the AWS managed policy AWSCloudShellFullAccess exists but is not attached to any users, groups, or roles. It must be explicitly assigned to grant permissions.

References

1. https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html

CIS Controls

MITRE ATT&CK Mappings

Profile

Level 1 | Manual