cis-aws-foundations-2-15

name	cis-aws-foundations-2.15
description	Ensure a support role has been created to manage incidents with AWS Support
category	cis-iam
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","iam","support-role","incident-management","least-privilege"]
cis_id	2.15
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-foundations-2.14","cis-aws-foundations-2.13"]
prerequisites	[]
severity_boost	{}

Ensure a support role has been created to manage incidents with AWS Support

Description

AWS provides a Support Center that can be used for incident notification and response, as well as technical support and customer service. Create an IAM role with the appropriate policy assigned to allow authorized users to manage incidents with AWS Support.

Rationale

Following the principle of least privilege, an IAM role should be used with a scoped policy to allow access to AWS Support. This ensures only authorized users can manage support cases without requiring broad administrative access.

Impact

Without a dedicated support role, access to AWS Support may require overly permissive roles, increasing the risk of excessive access and reducing separation of duties.

Audit Procedure

Using AWS Console

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam
2. In the left navigation pane, under Access management, select Policies
3. In the policy search field, enter AWSSupportAccess
4. Select the policy
5. Click the Entities attached tab
6. Ensure at least one IAM Role is attached

Using AWS CLI

1. Identify the AWS managed support policy:

aws iam list-policies --query "Policies[?PolicyName=='AWSSupportAccess'].Arn" --output text

2. Check if it is attached to any roles:

aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess

3. Ensure that at least one role is listed under PolicyRoles

Expected Result

At least one IAM role should be attached to the AWSSupportAccess policy. The policy ARN is arn:aws:iam::aws:policy/AWSSupportAccess.

Remediation

Using AWS Console

1. Sign in to the AWS Management Console and open the IAM console
2. Navigate to Roles
3. Click Create role
4. Configure the trusted entity (e.g., your AWS account or identity provider)
5. Attach the AWSSupportAccess policy
6. Complete role creation
7. Assign the role to appropriate users or groups