Cis AWS Storage 2.10
DevOps & Securitycis-aws-storage-2.10Cis AWS Storage 2.10 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure Resource Access via Tag-based Policies
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/AWS/CIS_AWS_Storage_Services_Benchmark_v1.0.0/cis-aws-storage-2.10/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-aws-storage-2-10, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
CIS Control 2.10: Ensure Resource Access via Tag-based Policies (Manual)
Profile Applicability
- Level 2
Description
For optimal granularity in EC2 access, configuring IAM policies via tags proves highly effective. This involves editing the policy text editor to specify access permissions based on specific tags.
Rationale
Implementing IAM policies based on tags in EC2 enables administrators to finely tailor access control, granting permissions dynamically according to resource attributes. This approach enhances security and scalability by aligning access rights with specific resource requirements while minimizing manual intervention.
Audit Procedure
Via AWS CLI
```bash
Check IAM policies for tag-based conditions
aws iam list-policies --scope Local
aws iam get-policy-version
--policy-arn <POLICY_ARN>
--version-id <VERSION_ID> | grep -i "aws:ResourceTag"
```
Remediation
Review existing IAM policies associated with EC2 resources to ensure they include tag-based conditions. Modify policies to incorporate tag-based conditions for granular access control.
References
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 6.7 Centralize Access Control | ● | ● | |
| v7 | 14.7 Enforce Access Control to Data through Automated Tools | ● |