Detections
Analytics

1.18 Ensure IAM instance roles are used for AWS resource access from instances

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. "AWS Access" means accessing the APIs of AWS in order to access AWS resources or manage AWS account resources.

AWS IAM roles reduce the risks associated with sharing and rotating credentials that can be used outside of AWS itself. Compromised credentials can be used from outside the AWS account to which they provide access. In contrast, to leverage role permissions, an attacker would need to gain and maintain access to a specific instance to use the privileges associated with it.

Additionally, if credentials are encoded into compiled applications or other hard-to-change mechanisms, they are even less likely to be properly rotated due to the risks of service disruption. As time passes, credentials that cannot be rotated are more likely to be known by an increasing number of individuals who no longer work for the organization that owns the credentials.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

From Console:

 - Sign in to the AWS Management Console and navigate to the EC2 dashboard at https://console.aws.amazon.com/ec2/
 - In the left navigation panel, choose Instances
 - Select the EC2 instance you want to modify.
 - Click Actions
 - Click Security
 - Click Modify IAM role
 - Click Create new IAM role if a new IAM role is required.
 - Select the IAM role you want to attach to your instance in the IAM role dropdown.
 - Click Update IAM role
 - Repeat steps 3 to 9 for each EC2 instance in your AWS account that requires an IAM role to be attached.

From Command Line:

 - Run the describe-instances command to list all EC2 instance IDs in the selected AWS region:

aws ec2 describe-instances --region <region-name> --query 'Reservations[*].Instances[*].InstanceId' <xhtml:ol start="2"> - Run the associate-iam-instance-profile command to attach an instance profile (which is attached to an IAM role) to the EC2 instance:

aws ec2 associate-iam-instance-profile --region <region-name> --instance-id <Instance-ID> --iam-instance-profile Name="Instance-Profile-Name" <xhtml:ol start="3"> - Run the describe-instances command again for the recently modified EC2 instance. The command output should return the instance profile ARN and ID:

aws ec2 describe-instances --region <region-name> --instance-id <Instance-ID> --query 'Reservations[*].Instances[*].IamInstanceProfile' <xhtml:ol start="4"> - Repeat steps 2 and 3 for each EC2 instance in your AWS account that requires an IAM role to be attached.

See Also

https://workbench.cisecurity.org/benchmarks/19631

Item Details

References: CSCv7|14.1

Plugin: amazon_aws

Control ID: 8d6239f31e1272d2981422d5b0d51e2b7b62c4c0baa663c23952044a7b85db2e