| name | cis-aws-foundations-2.14 |
| description | Ensure IAM policies that allow full "*:*" administrative privileges are not attached |
| category | cis-iam |
| version | 7.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","iam","policies","admin-privileges","least-privilege","permissions"] |
| cis_id | 2.14 |
| cis_benchmark | CIS AWS Foundations Benchmark v7.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-foundations-2.13","cis-aws-foundations-2.15","cis-aws-foundations-2.21"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure IAM policies that allow full ":" administrative privileges are not attached
Description
IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered standard security advice to grant least privilege, granting only the permissions required to perform a task. Determine what users need to do, and then craft policies for them that allow the users to perform only those tasks, instead of granting full administrative privileges.
Rationale
It is more secure to start with a minimal set of permissions and grant additional permissions as necessary, rather than starting with overly permissive access and attempting to restrict it later.
Providing full administrative privileges instead of restricting access to the minimum required exposes resources to potentially unintended or malicious actions.
IAM policies that contain a statement with "Effect": "Allow" and "Action": "*" over "Resource": "*" should be removed.
Impact
Policies granting full administrative privileges significantly increase the risk of unauthorized or unintended actions, potentially resulting in complete account compromise.
Audit Procedure
Using AWS CLI
- Run the following to get a list of IAM policies:
aws iam list-policies --only-attached --output text
-
For each policy returned, evaluate the default policy version to determine if it allows full administrative privileges (":"). The default version represents the effective permissions applied.
-
Alternatively, the following command can be used to identify all attached policies that allow full administrative privileges and list associated entities:
policies=$(aws iam list-policies --scope All --only-attached --query 'Policies[*].Arn' --output text)
for arn in $policies; do
version=$(aws iam get-policy --policy-arn "$arn" --query 'Policy.DefaultVersionId' --output text)
is_admin=$(aws iam get-policy-version --policy-arn "$arn" --version-id "$version" --query 'PolicyVersion.Document' | jq -r )
[ ! -z ];
aws iam list-entities-for-policy --policy-arn --query --output yaml
