cis-aws-storage-2-7

name	cis-aws-storage-2.7
description	Ensure creating IAM User
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","iam","iam-user","identity-verification","access-control"]
cis_id	2.7
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack	["aws"]
cwe_ids	["CWE-284"]
chains_with	["cis-aws-storage-2.6","cis-aws-storage-2.8","cis-aws-storage-2.9"]
prerequisites	[]
severity_boost	{}

CIS Control 2.7: Ensure creating IAM User (Manual)

Profile Applicability

• Level 2

Description

IAM users are individuals whose accounts have been created by the AWS administrator, providing them with access to specific AWS resources. These users have undergone identity verification with your organization, ensuring that only authorized personnel can manage and interact with your AWS environment.

Rationale

The purpose of creating IAM users and verifying their identities with your organization is to ensure that only authorized individuals have access to AWS resources, enhancing security and preventing unauthorized access. This practice helps maintain control over your AWS environment, ensuring that sensitive data and critical operations are managed by trusted and validated personnel.

Impact

Not creating IAM users and verifying their identities can lead to unauthorized access to your AWS resources, increasing the risk of security breaches and data leaks. This lack of control can result in compromised sensitive data, unauthorized changes to critical systems, and overall reduced security posture, potentially causing significant operational and financial damage to your organization.

Audit Procedure

Via AWS Management Console

1. Access the AWS Management Console

   • Log in to your AWS account and navigate to the AWS Management Console

2. Review IAM Users

   • Go to the IAM Dashboard and select "Users"
   • Check the list of IAM users to ensure that only authorized users are present

3. Check User Details

   • For each user, click on their name to view their details
   • Verify the "User ARN" and ensure that the user was created by an authorized administrator
   • Check the "Security credentials" tab to see if Multi-Factor Authentication (MFA) is enabled for added security

4. Verify Identity Policies

   • Review the policies attached to each user to ensure they are appropriate for the user's role
   • Check that permissions follow the principle of least privilege, granting only the necessary access

5. Monitor Login Activity

   • Use AWS CloudTrail to review login activities for each IAM user
   • Check for any unusual login patterns or unauthorized access attempts

6. Use AWS IAM Access Analyzer

   • Enable IAM Access Analyzer to identify any IAM resources shared outside your AWS account