Rule: IAM Policy Should Not Have Statements with Admin Access

Rule Description

Remediation Steps

Step 1: Review existing IAM policies

2. 1.
   Access the AWS Management Console.
4. 2.
   Go to the IAM service.

Step 2: Identify policies with admin access

2. 1.
   Within the IAM console, navigate to the "Policies" section.
4. 2.
   Review each policy and its statements.
6. 3.
   Look for policies that contain statements granting admin access for NIST CSF v1.

Step 3: Modify policies to remove admin access

2. 1.
   Select the policy that contains admin access for NIST CSF v1.
4. 2.
   Edit the policy.
6. 3.
   Identify the specific statement(s) granting admin access.
8. 4.
   Remove the statement(s) from the policy.

Step 4: Validate policy changes

2. 1.
   Save the modified policy.
4. 2.
   Test the new policy to ensure it no longer grants admin access for NIST CSF v1.

Troubleshooting Steps

Step 1: Identify the issue

2. 1.
   Review the policy that was modified.
4. 2.
   Verify if any errors or misconfigurations were made during the modification process.

Step 2: Rollback changes if necessary

2. 1.
   If the issue is significant or there are unintended consequences, revert to the previous version of the policy.
4. 2.
   Evaluate and validate the reverted policy to ensure it no longer grants admin access for NIST CSF v1.

Step 3: Analyze error logs or policies

2. 1.
   Check error logs or review policy statements for any inconsistencies or mistakes.
4. 2.
   Ensure the policy is correctly written, following the AWS IAM policy language syntax.

Step 4: Seek assistance from AWS support if needed

2. 1.
   If troubleshooting steps do not resolve the issue, contact AWS support for further assistance.
4. 2.
   Provide them with detailed information about the problem and the steps you've taken so far.

Necessary Code

Verification

2. 1.
   Test the modified policy by assigning it to an appropriate IAM user or group.
4. 2.
   Attempt to perform administrative actions that were previously allowed with the policy.
6. 3.
   Verify that the attempted administrative actions are denied or restricted.