Ensure there is no IAM policy with invalid global condition keys

LOW

Description

Invalid global condition key. The condition key does not exist.

Remediation

In AWS Console -

  1. Sign in to the AWS console and go to the IAM console.
  2. In the Navigation pane, select Policies.
  3. In the list of policies, select the policy to edit.
  4. Select the Permissions tab, and then choose Edit policy.
  5. On the review page, review the changes and click Save.

In Terraform -

  1. In the aws_iam_policy, aws_iam_role_policy, aws_iam_group_policy, and aws_iam_user_policy resources, edit the policy field so that the allowed Action list and/or Principal have appropriate values rather than a wildcard.
  2. Update the Resource ARN list to use specific IDs with valid regions rather than a wildcard.
  3. When using a Global Condition statement, ensure a valid Condition is chosen.
    For more information on how to effectively write an IAM policy, including all of the available operators for a Condition block, see the AWS and Terraform documentation.

References:
https://docs.aws.amazon.com/IAM/latest/UserGuide/service_code_examples_iam.html
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy

Policy Details

Rule Reference ID: AC_AWS_0477
CSP: AWS
Remediation Available: No
Resource: aws_iam_policy
Resource Type: Policy

Frameworks