cis-aws-database-11-1

name	cis-aws-database-11.1
description	Ensure to Implement Identity and Access Management (IAM)
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","qldb","ledger","iam","authentication","access-control"]
cis_id	11.1
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-11.2","cis-aws-database-11.3","cis-aws-database-11.5"]
prerequisites	[]
severity_boost	{}

11.1 Ensure to Implement Identity and Access Management (IAM) (Manual)

Description

This control is important because by having IAM roles implemented in the database it only allows certain people who are authenticated into the database to modify the database and would not give access to unauthorized personnel. This ensures that the data is being protected from any threat actor.

Rationale

IAM provides centralized authentication and authorization for QLDB resources, ensuring only authorized users and services can access the ledger database.

Impact

Only authorized personnel can access the database and configure the applications by using their IAM credentials. If the user credentials are compromised by an unauthorized user, it would limit them to access specific areas within the database due to the leverage IAM roles established.

Audit Procedure

Using AWS Console

1. Understand IAM and QLDB Integration:
   • Familiarize yourself with IAM and its role in controlling access to AWS services, including QLDB.
   • Understand how IAM policies define permissions and access control rules for QLDB resources.
2. Define IAM Users and Groups:
   • Identify the users and groups that will need access to QLDB.
   • Create IAM user accounts for individuals who require direct access to QLDB.
   • Create IAM groups to organize users based on their roles or responsibilities logically.
3. Define IAM Policies:
   • Determine the permissions and actions users and groups need to perform on QLDB resources.
   • Create custom IAM policies or leverage existing IAM-managed policies to define these permissions.
   • Consider the principle of least privilege and grant only the necessary permissions for each user or group.
4. Attach IAM Policies to Users and Groups:
   • Associate the appropriate IAM policies with the IAM users and groups.
   • Ensure that each user or group has the necessary permissions to perform their tasks on QLDB.
   • Regularly review and update the assigned policies as access requirements evolve.
5. Leverage IAM Roles:
   • Identify AWS services or applications that require access to QLDB.
   • Create IAM roles to provide temporary credentials and permissions for these services.
   • Define trust relationships and establish the necessary permissions in the IAM role policies.
6. Enable IAM Database Authentication:
   • Configure IAM database authentication for QLDB to allow users to authenticate using their IAM credentials.
   • Enable the appropriate IAM authentication option in the QLDB configuration.