cis-aws-euc-2-1

name	cis-aws-euc-2.1
description	Ensure Administration of WorkSpaces is defined using IAM
category	cis-end-user-compute
version	1.2.0
author	cyberstrike-official
tags	["cis","aws","end-user-compute","workspaces","iam","authorization"]
cis_id	2.1
cis_benchmark	CIS AWS End User Compute Services Benchmark v1.2.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-euc-2.2"]
prerequisites	[]
severity_boost	{}

Ensure Administration of WorkSpaces is defined using IAM (Manual)

Profile Applicability

• Level 1

Description

To allow users to administer Amazon WorkSpaces, IAM policies must be created and attached with the required permissions to an IAM Principal used for administration of Amazon WorkSpaces. An IAM Principal may be a IAM Role or an IAM User, or an IAM User Group with Users within the User Group.

AWS has an AWS Managed Policy, AmazonWorkSpacesAdmin that grants permissions to administer Amazon WorkSpaces. A custom managed policy or inline policy may be used to grant WorkSpaces permissions to the IAM Principal.

Rationale

Creating and managing Workspaces specific users is not done in AWS IAM. Creating and managing Workspaces specific users is done within the Workspace service console. In order to properly administer Workspaces specific users, an IAM Principal with proper permissions must be created.

Impact

None specified in the benchmark.

Audit Procedure

Using AWS Console

1. Login in and open the IAM console at https://console.aws.amazon.com/iam/
2. In the left pane click on User Groups, Users, or Roles
3. Click on the IAM Principal (User, Group, or Role) that is to be used to administer Workspaces
4. Click on Permissions and confirm that the AmazonWorkSpacesAdmin policy or the proper permissions are attached

Using AWS CLI

Run the appropriate command to determine permissions for the IAM Principal:

# For attached managed policies
aws iam list-attached-role-policies --role-name <workspace_group_name>

# For inline policies
aws iam get-role-policy --role-name <role_name> --policy-name <policy_name>

Expected Result

The AWS managed policy AmazonWorkSpacesAdmin or a custom WorkSpaces Admin policy should be attached to the IAM Principal for administration of WorkSpaces.

Remediation

Using AWS Console

If the IAM Principal for WorkSpaces Administration exists but does not have the policy attached:

1. Login to the IAM console at https://console.aws.amazon.com/iam/
2. In the left pane click on either User Groups, Users, or Roles
3. Click the proper IAM Principal