Severity : Medium
Description:
...
This control ensures that no IAM roles used to establish a trusted relationship between an AWS account and a third-party entity are using Multi-Factor Authentication or external IDs to secure the access to resources. Cross-service impersonation can result in the confused deputy problem. Cross-service impersonation can occur when one service calls another service. The calling service can be manipulated to use its permissions to act on another customer's resources in a way it should not otherwise have permission to access. It is highly recommended if administrative access to the 3rd party account can assume this IAM role, users must be in the trusted account and provide the exact external ID or the unique passcode generated by the MFA device.
Remediation Steps:
Perform following to create a IAM role with external ID and MFA for cross account access :
Login to the AWS Management Console at https://console.aws.amazon.com.
Navigate to IAMÂ console.
In the navigation pane, click Roles and then Create Role.
Choose the Another AWS account role type.
For Account ID, type the AWS account ID to which to grant access to resources.
Select Require external ID. Enter external ID that is agreed upon between this account and the administrator of the third-party account.
Select Require MFA.
Choose Next: Permissions.
Select a policy to use for the permissions policy or choose Create policy to create a new policy.
Open the Set permissions boundary section and choose Use a permissions boundary to control the maximum role permissions. Select the policy to use for the permissions boundary.
Choose Next: Tags.
Choose Next: Review.
For Role name, type a name for role.
For Role description, type a description.
Choose Create role.
Important:
Account administrator must configured external ID use when creating a role for a third party that accesses other AWS accounts in addition to this account.
In a scenario, when assuming roles on behalf of different customers, assign a unique external ID to each customer and instruct them to add the external ID to their role's trust policy.
Reference: