Ensure there is no IAM policy with a condition element having IpAddress Condition Operator with value not following standard CIDR

LOW

Description

The non-zero bits in the IP address after the masked bits are ignored. This may lead to development of IAM policies that do not follow standard CIDR notations.

Remediation

In AWS Console -

  1. Sign in to the AWS console and go to the IAM console.
  2. In the Navigation pane, select Policies.
  3. In the list of policies, select the policy to edit.
  4. Select the Permissions tab, and then choose Edit policy.
  5. On the review page, review the changes and click Save.

In Terraform -

  1. In the aws_iam_policy, aws_iam_role_policy, aws_iam_group_policy, and aws_iam_user_policy resources, edit the CIDR notation for the IpAddress aws:SourceIp Condition so that it's in a proper format.
    For more information on how to effectively write an IAM policy see the AWS and Terraform documentation.

References:
https://docs.aws.amazon.com/IAM/latest/UserGuide/service_code_examples_iam.html
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy

Policy Details

Rule Reference ID: AC_AWS_0412
CSP: AWS
Remediation Available: Yes
Resource: aws_iam_policy
Resource Type: Policy

Frameworks