cis-aws-foundations-2-20

name	cis-aws-foundations-2.20
description	Ensure access to AWSCloudShellFullAccess is restricted
category	cis-iam
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","iam","cloudshell","data-exfiltration","least-privilege","policies"]
cis_id	2.20
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-foundations-2.14","cis-aws-foundations-2.13"]
prerequisites	[]
severity_boost	{}

Ensure access to AWSCloudShellFullAccess is restricted

Description

AWS CloudShell is a convenient way of running CLI commands against AWS services. The managed IAM policy AWSCloudShellFullAccess provides full access to CloudShell, including file upload and download capability between a user's local system and the CloudShell environment. Within the CloudShell environment, a user has sudo permissions and can access the internet. It is therefore possible to install software and transfer data to external systems.

Rationale

Access to this policy should be restricted, as it presents a potential channel for data exfiltration by privileged users. AWS documentation provides guidance on creating more restrictive policies that limit file transfer capabilities.

Impact

Unrestricted access to CloudShell may allow users to transfer data outside the AWS environment, increasing the risk of data exfiltration and loss of sensitive information.

Audit Procedure

Using AWS Console

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam
2. In the left pane, select Policies
3. Search for and select AWSCloudShellFullAccess
4. Select the Entities attached tab
5. Ensure that no users, groups, or roles are attached

Using AWS CLI

1. Run the following command:

aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AWSCloudShellFullAccess

2. In the output, ensure the following are empty:

• PolicyUsers
• PolicyRoles
• PolicyGroups

Example:

PolicyRoles: [ ]

Expected Result

The AWSCloudShellFullAccess policy should not be attached to any users, groups, or roles. All three lists (PolicyUsers, PolicyRoles, PolicyGroups) should be empty.

Remediation

Using AWS Console

1. Open the IAM console at https://console.aws.amazon.com/iam/
2. In the left pane, select Policies
3. Search for and select AWSCloudShellFullAccess
4. Select the Entities attached tab
5. For each attached entity: