cis-aws-storage-1-5

name	cis-aws-storage-1.5
description	Ensure to create IAM roles for Backup
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","backup","iam","iam-role","service-role","least-privilege"]
cis_id	1.5
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack	["aws"]
cwe_ids	["CWE-284"]
chains_with	["cis-aws-storage-1.4","cis-aws-storage-1.6"]
prerequisites	["cis-aws-storage-1.1","cis-aws-storage-1.4"]
severity_boost	{}

CIS Control 1.5: Ensure to create IAM roles for Backup (Manual)

Profile Applicability

• Level 2

Description

An AWS Identity and Access Management (IAM) role is similar to a user, in that it is an AWS identity with permissions policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it.

Rationale

While Service Linked Roles offer quick deployment, using default configurations isn't recommended for security best practices.

Creating custom IAM roles for AWS Backup allows you to:

• Implement principle of least privilege
• Control exactly which services and resources the backup service can access
• Audit and track backup operations more effectively
• Separate backup permissions from other administrative functions

Impact

Not properly configuring IAM roles for AWS Backup can result in:

• Over-permissive backup access using default service roles
• Inability to track which role performed backup operations
• Difficulty implementing fine-grained access controls
• Compliance violations related to access management
• Potential for backup service to access resources beyond what's necessary

Audit Procedure

Via AWS Management Console

To create a role for AWS Backup, follow these steps:

1. Navigate to the "IAM Dashboard" in the AWS Console
2. Select "Roles" from the left-hand menu
3. Click on the "Create Role" button
4. Choose "AWS Service" as the trusted entity
5. Select "AWS Backup" as the service that will use this role
6. Choose a policy to apply to the role or create a custom policy
7. Review the role details and provide a meaningful name for the role
8. Click on "Create Role" to finalize the creation of the role for AWS Backup

Via AWS CLI

# List IAM roles related to backup
aws iam list-roles | grep -i backup

# Get details of a specific backup role
aws iam get-role --role-name <ROLE_NAME>

# List policies attached to the backup role
aws iam list-attached-role-policies --role-name <ROLE_NAME>

# Get the trust relationship (assume role policy)
aws iam get-role --role-name <ROLE_NAME> \
  --query 'Role.AssumeRolePolicyDocument'

Expected Result