Ensure cloud users don't have any direct permissions in AWS IAM Policy

MEDIUM

Description

Cloud Users have direct permissions in AWS IAM Policy. Using direct permissions is overly permissive and may lead access to sensitive resources.

Remediation

In AWS Console -

  1. Sign in to the AWS console and go to the IAM console.
  2. In the Navigation pane, select Policies.
  3. In the list of policies, select the policy to edit.
  4. Select the Permissions tab, and then choose Edit policy.
  5. On the review page, review the changes and click Save.

In Terraform -

  1. Rather than using an aws_iam_user_policy resource, configure the aws_iam_user and aws_iam_group to assign policies.
    For more information on how to effectively write an IAM policy see the AWS and Terraform documentation.

References:
https://docs.aws.amazon.com/IAM/latest/UserGuide/service_code_examples_iam.html
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_group
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy

Policy Details

Rule Reference ID: AC_AWS_0431
CSP: AWS
Remediation Available: No
Resource: aws_iam_policy
Resource Type: Policy

Frameworks