Ensure IAM Access Analyzer Rule

Ensure that IAM Access Analyzer is Enabled for All Regions for CIS v1.5.0

Definition

Troubleshooting Steps

2. 1.

   Verify IAM Access Analyzer Status

   • Navigate to IAM Console > Access Analyzer.
   • Ensure that the analyzer is present. If not, create one.
4. 2.

   Check for Region-Specific Issues

   • The Access Analyzer must be enabled in all regions regardless of resource presence.
   • Confirm that the analyzer is not just enabled for selective regions.
6. 3.

   Permissions

   • Ensure that your IAM user or role has the necessary permissions to create and manage Access Analyzer.
8. 4.

   Service Quotas

   • Check if there are any service quotas being hit that prevent Access Analyzer from being enabled.

Necessary CLI Commands for Remediation

2. 1.

   List Existing Analyzers

   aws accessanalyzer list-analyzers --region us-east-1
   

4. 2.

   Create Analyzer for Each Region The following script loops through all AWS regions and creates an analyzer if not already present.

   for region in `aws ec2 describe-regions --all-regions --query "Regions[].RegionName" --output text`
   do
       analyzers=$(aws accessanalyzer list-analyzers --region $region --output text --query "analyzers")
       if [ -z "$analyzers" ]; then
           aws accessanalyzer create-analyzer --region $region --analyzer-name "DefaultAnalyzer" --type "ORGANIZATION" --archive-rules '[]'
       else
           echo "Access Analyzer already exists in $region region"
       fi
   done
   

6. 3.

   Verify Analyzers in All Regions Check if analyzers are correctly set up in all regions by re-running the list command.

Step-by-Step Guide for Remediation

2. 1.

   Navigate to the IAM Console

   • Go to your AWS Management Console.
   • Open the IAM service.
4. 2.

   Access Analyzer

   • In the IAM console, select "Access Analyzer" on the left panel.
6. 3.

   Create Analyzer

   • Click “Create analyzer” if none exists.
   • Provide a name for the analyzer.
8. 4.

   Select Type

   • When prompted for the type, select "Organization" if setting up at the organization level, or "Account" if at the account level.
10. 5.

    Apply Across Regions

    • Ensure that you apply the settings across all regions.
12. 6.

    Review and Create

    • Review your settings and create the analyzer.
14. 7.

    Automate with CLI or Infrastructure as Code (IaC)

    • Optionally, automate the setup across all regions using the provided AWS CLI commands or leverage IaC tools like AWS CloudFormation or Terraform.
16. 8.

    Monitor and Review

    • Regularly check the Access Analyzer for any findings and review the shared resources.