IAM Policy Should Not Have Statements with Admin Access
This rule details that IAM policy should not include statements granting admin access.
| Rule | IAM policy should not have statements with admin access |
| Framework | NIST 800-53 Revision 5 |
| Severity | ✔ High |
Rule Description:
The IAM policy should not include statements granting admin access as per NIST 800-53 Revision 5. Admin access refers to the highest level of privileges that can be granted in an AWS account, allowing complete control over resources and services. This rule is enforced to adhere to security best practices and prevent unauthorized access or misuse of sensitive data.
Troubleshooting Steps:
If you encounter any issues related to IAM policies with admin access, follow these troubleshooting steps:
- 1.Identify the affected IAM policy: Review the IAM policies associated with the user, group, or role that is experiencing the issue.
- 2.Verify NIST 800-53 compliance: Check if the policy statement grants admin access or privileges that violate the NIST 800-53 Revision 5 guidelines.
- 3.Review policy statements: Analyze each statement within the policy to identify the one granting admin access. Pay attention to the "Effect", "Action", "Resource", and "Condition" fields.
Remediation:
To remediate the IAM policy that violates the rule, follow the step-by-step guide below:
- 1.Open the AWS Management Console and navigate to the IAM service.
- 2.Identify the user, group, or role associated with the policy that needs to be modified.
- 3.Select the corresponding entity and click the "Permissions" tab.
- 4.Under the "Inline Policies" or "Managed Policies" section, locate the policy that violates the rule.
- 5.Click on the policy name to open the policy editor.
- 6.Identify the statement granting admin access within the policy.
- 7.Modify the policy by removing or updating the statement to only grant the necessary permissions according to the principle of least privilege.
- 8.Click "Review Policy" to validate the changes made.
- 9.If there are no validation errors, click "Save Changes" to apply the updated policy.
Relevant Code:
If you prefer to use AWS CLI or AWS SDK for automation, here's an example command to update an IAM policy:
aws iam put-user-policy --user-name <USER_NAME> --policy-name <POLICY_NAME> --policy-document file://policy.json
Ensure that you replace
<USER_NAME><POLICY_NAME>policy.jsonConclusion:
By following the troubleshooting steps and performing the recommended remediation actions, you can ensure that the IAM policy adheres to the security requirements defined by NIST 800-53 Revision 5. Regularly reviewing and updating policies can help ensure proper access controls and minimize the risk of unauthorized privilege escalation within your AWS environment.