cis-aws-storage-1-4

name	cis-aws-storage-1.4
description	Ensure to create AWS IAM Policies
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","backup","iam","iam-policy","access-control","least-privilege"]
cis_id	1.4
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack	["aws"]
cwe_ids	["CWE-284"]
chains_with	["cis-aws-storage-1.2","cis-aws-storage-1.5","cis-aws-storage-1.6"]
prerequisites	["cis-aws-storage-1.1"]
severity_boost	{}

CIS Control 1.4: Ensure to create AWS IAM Policies (Manual)

Profile Applicability

• Level 2

Description

AWS IAM policies specify the desired permissions for accessing AWS resources and define the conditions under which those permissions are granted. Configure the appropriate policies to keep your resources secure.

Rationale

Managing AWS IAM policies is crucial to safeguard your backups from unauthorized access, ensuring that only approved users can manipulate or view sensitive data.

Properly configured IAM policies implement the principle of least privilege, granting only the minimum permissions necessary for users and services to perform their designated tasks. This minimizes the risk of accidental or malicious data exposure and unauthorized backup modifications.

Impact

Not implementing proper IAM policies for AWS Backup can lead to:

• Unauthorized access to backup data
• Backup tampering or deletion by unauthorized users
• Non-compliance with regulatory requirements
• Inability to track who accessed or modified backups
• Privilege escalation vulnerabilities

Audit Procedure

Via AWS Management Console

To create a role for AWS Backup, follow these steps:

1. Navigate to the "IAM Dashboard" in the AWS Console
2. Select "Roles" from the left-hand menu
3. Click on the "Create Role" button
4. Choose "AWS Service" as the trusted entity
5. Select "AWS Backup" as the service that will use this role
6. Choose a policy to apply to the role or create a custom policy
7. Review the role details and provide a meaningful name for the role
8. Click on "Create Role" to finalize the creation of the role for AWS Backup

Via AWS CLI

# List IAM policies related to backups
aws iam list-policies --scope Local | grep -i backup

# Get a specific policy document
aws iam get-policy --policy-arn <POLICY_ARN>

# Get policy version details
aws iam get-policy-version \
  --policy-arn <POLICY_ARN> \
  --version-id <VERSION_ID>

# List roles and their attached policies
aws iam list-roles | grep -i backup

# List policies attached to a specific role
aws iam list-attached-role-policies --role-name <ROLE_NAME>

Expected Result

• IAM policies for AWS Backup follow least privilege principle
• Backup-specific policies are created and properly scoped