cis-aws-euc-4-1

name	cis-aws-euc-4.1
description	Ensure Administrators of WorkDocs is defined using IAM
category	cis-end-user-compute
version	1.2.0
author	cyberstrike-official
tags	["cis","aws","end-user-compute","workdocs","iam","access-control"]
cis_id	4.1
cis_benchmark	CIS AWS End User Compute Services Benchmark v1.2.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure Administrators of WorkDocs is defined using IAM (Automated)

Profile Applicability

• Level 1

Description

Administration of AWS WorkDocs should be defined using AWS Identity and Access Management (IAM).

Rationale

By default, IAM users and roles don't have permission to create or modify Amazon WorkDocs resources. Using IAM to manage WorkDocs administrators ensures proper access control and follows the principle of least privilege.

Impact

None - this is a security best practice.

Audit Procedure

Using AWS Console

1. Log in to the IAM console at https://console.aws.amazon.com/iam/
2. In the left pane, click Groups and then click Create New Group
3. In the Group Name box, type the name of the group and then click Next Step
4. In the list of policies, select the check box for AmazonWorkDocsFullAccess
5. Click Next Step
6. Click Create Group

Add users to the Amazon WorkDocs Full Access group:

1. Log in to the IAM console at https://console.aws.amazon.com/iam/
2. In the left pane, click Groups
3. Select the group you created above
4. Click Add Users To Group
5. Select the users to be added to the group
6. Click Add Users

Using AWS CLI

Not applicable for this control - must be configured via Console.

Expected Result

IAM group with AmazonWorkDocsFullAccess policy exists and WorkDocs administrators are members of this group.

Remediation

Using AWS Console

Perform the following to create an IAM group and assign the Amazon WorkDocs Full Access policy to it:

1. Log in to the IAM console at https://console.aws.amazon.com/iam/
2. In the left pane, click Groups and then click Create New Group
3. In the Group Name box, type the name of the group and then click Next Step
4. In the list of policies, select the check box for AmazonWorkDocsFullAccess
5. Click Next Step
6. Click Create Group

Perform the following to add a user to a Amazon WorkDocs Full Access group: