AWS-IAM-Custom-Policy-With-Permissive-Role

Severity : Critical

Description: This control ensures that IAM roles policy which allows to assume role are not very permissive and follow the principal of least privilege to perform the tasks. IAM role with right permission significantly reduce the unauthorized access to resources. IAM role policies which allows all actions with action statement with wildcard (*) or IAM::* , with action statement with sts:AssumeRole and principal statement as AWS::”*”, with action statement IAM::PassRole and resources statement with wildcard(*) are too permissive and must be updated to specific actions.

Remediation Steps:

Perform following to update the custom managed IAM role policies :

1. Login to the AWS Management Console at https://console.aws.amazon.com.

2. Navigate to IAM console.

3. In the navigation pane, click Roles.

4. Select the roles reported.

5. Choose Permission.

6. Under Managed Policy, open the policy to edit.

7. On Policy Details, select Policy Document and click Edit.

8. Update the policy by replacing the wildcard(*) in Action with specific action, resources for specific resources, Principal with selected principal or a conditional statement for principal.

9. Select validate Policy.

10. Choose Save.

Important:

Reference:

• IAM role management - AWS Identity and Access Management