cis-aws-database-2-7

name	cis-aws-database-2.7
description	Ensure Least Privilege Access
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","aurora","least-privilege","iam","polp","access-control"]
cis_id	2.7
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-2.4","cis-aws-database-2.10"]
prerequisites	[]
severity_boost	{}

2.7 Ensure Least Privilege Access (Manual)

Description

Use the principle of least privilege when granting access to your Amazon Aurora resources. This principle of least privilege (POLP) is a computer security concept where users are given the minimum access levels necessary to complete their job functions.

In Amazon Aurora, this can be implemented at various levels, including AWS IAM for managing AWS resources and within the database for managing database users and roles.

Here is a step-by-step guide for each:

Rationale

POLP limits the user interaction on the database, and it only gives the database permission to complete the necessary or mandatory task. AWS IAM gives permission for what the entity can and cannot do. Incorporating both POLP and AWS IAM in a database gives limited permission to the user to complete the tasks.

Impact

Users would need to create a IAM role to implement POLP into their database.

Audit Procedure

Implementing POLP with AWS IAM

Using AWS Console

1. Sign in to AWS Management Console

   • If you do not already have an AWS account, you will need to create one at https://aws.amazon.com.

2. Navigate to IAM Dashboard

   • Navigate to the IAM service once logged in to the AWS Management Console.
   • You can find this under the Security, Identity, & Compliance category.

3. Create a new IAM role or user

   • If creating a new IAM role or user, click Roles or Users.
   • Then Create role or Create user.

4. Attach minimum necessary permissions

   • When attaching policies, give only the permissions necessary to perform the intended tasks.
   • AWS provides many predefined policies designed following the POLP. You can create a custom policy with precise permissions if none suits your needs.

Implementing POLP within Amazon Aurora

1. Log into your Aurora Database

   • Depending on your Aurora database engine, you can log in through the terminal using a MySQL or PostgreSQL client. You'll need your host endpoint, username, and password to log in.

2. Create a new user

   • You can create a new user with the CREATE USER command in SQL.