Ensure Inline Policies for IAM Users, Roles, and Groups Rule

Rule Description

Policy Verification Steps

2. 1.
   Identify the IAM users, roles, and groups that have inline policies attached.
4. 2.
   Check each inline policy attached to IAM users, roles, and groups for any blocked actions on KMS keys.
6. 3.
   Ensure that no actions are explicitly denied or blocked for KMS keys in the inline policies.
8. 4.
   Validate that all the permissions defined in the inline policies are necessary and aligned with the organization's security and compliance requirements.

Troubleshooting Steps

2. 1.
   Review the inline policy attached to the IAM user, role, or group.
4. 2.
   Identify the specific blocked actions that need to be removed or modified.
6. 3.
   Determine if the blocked actions listed in the policy are necessary for any legitimate business requirements and consider modifying the policy accordingly.
8. 4.
   Consult with the relevant stakeholders to understand the appropriate actions needed for specific KMS keys.
10. 5.
    Create a modified or new inline policy that removes the blocked actions or provides the necessary access while complying with GxP and 21 CFR Part 11 regulations.

Neccessary Codes

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": "kms:Encrypt",
            "Resource": "arn:aws:kms:region:account-id:key/key-id"
        }
    ]
}

Remediation Steps

2. 1.

   Identify the IAM user, role, or group whose policy needs to be remediated.

4. 2.

   Determine whether modifying the existing inline policy or creating a new one is more appropriate for your use case.

6. 3.

   Understand the specific actions that should be allowed or denied for the KMS keys involved.

8. 4.

   Access the AWS Management Console or use the AWS Command Line Interface (CLI) for further actions.

10. 5.

    If modifying an existing policy:

    • Open the IAM service in the AWS Management Console.
    • Navigate to the "Users," "Roles," or "Groups" page depending on your case and select the appropriate user, role, or group.
    • Choose the "Permissions" tab.
    • Click on the inline policy that needs to be modified.
    • Update the policy by removing any blocked actions related to KMS keys or modifying permissions as per requirements.
    • Save the changes to the policy.
12. 6.

    If creating a new policy:

    • Open the IAM service in the AWS Management Console.
    • Navigate to the "Users," "Roles," or "Groups" page depending on your case and select the appropriate user, role, or group.
    • Choose the "Permissions" tab.
    • Click on the "Add inline policy" button.
    • Enter a policy name and description.
    • Use the necessary code provided earlier to define the policy with appropriate permissions for KMS keys.
    • Save the new inline policy.