cis-aws-foundations-2-14

name	cis-aws-foundations-2.14
description	Ensure IAM policies that allow full "*:*" administrative privileges are not attached
category	cis-iam
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","iam","policies","admin-privileges","least-privilege","permissions"]
cis_id	2.14
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-foundations-2.13","cis-aws-foundations-2.15","cis-aws-foundations-2.21"]
prerequisites	[]
severity_boost	{}

Ensure IAM policies that allow full ":" administrative privileges are not attached

Description

IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered standard security advice to grant least privilege, granting only the permissions required to perform a task. Determine what users need to do, and then craft policies for them that allow the users to perform only those tasks, instead of granting full administrative privileges.

Rationale

It is more secure to start with a minimal set of permissions and grant additional permissions as necessary, rather than starting with overly permissive access and attempting to restrict it later.

Providing full administrative privileges instead of restricting access to the minimum required exposes resources to potentially unintended or malicious actions.

IAM policies that contain a statement with "Effect": "Allow" and "Action": "*" over "Resource": "*" should be removed.

Impact

Policies granting full administrative privileges significantly increase the risk of unauthorized or unintended actions, potentially resulting in complete account compromise.

Audit Procedure

Using AWS CLI

1. Run the following to get a list of IAM policies:

aws iam list-policies --only-attached --output text

2. For each policy returned, evaluate the default policy version to determine if it allows full administrative privileges (":"). The default version represents the effective permissions applied.

3. Alternatively, the following command can be used to identify all attached policies that allow full administrative privileges and list associated entities:

policies=$(aws iam list-policies --scope All --only-attached --query 'Policies[*].Arn' --output text)

for arn in $policies; do
  version=$(aws iam get-policy --policy-arn "$arn" --query 'Policy.DefaultVersionId' --output text)

  is_admin=$(aws iam get-policy-version --policy-arn "$arn" --version-id "$version" --query 'PolicyVersion.Document' | jq -r )

   [ ! -z  ]; 
     
     
     
    aws iam list-entities-for-policy --policy-arn  --query  --output yaml