Ensure AWS IAM managed policies do not have 'getObject' or full S3 action permissions

Risk Level: Critical
Cloud Entity: IAM Policy
CloudGuard Rule ID: D9.AWS.IAM.71
Category: Security, Identity, & Compliance

GSL LOGIC

IamPolicy where name regexMatch /AWS/ should not have document.Statement contain [ Effect='Allow' and (Action='S3:*' or Action='s3:getObject') ]

REMEDIATION

Note: AWS managed policies cannot be deleted.

From Portal

1. Go to 'IAM'
2. In the menu, under 'Access management', choose 'Policies'
3. For each incompliant policy, make sure there are no IAM entities attached to it:
4. Choose the incompliant policy
5. Under 'Policy usage', detach any IAM entity attached to it

From Command Line
To remove the specified managed policy from a specified user, run:

aws iam detach-user-policy --user-name USER-NAME --policy-arn POLICY-ARN

To remove the specified managed policy from a specified IAM group, run:

aws iam detach-group-policy --group-name GROUP-NAME --policy-arn POLICY-ARN

To remove the specified managed policy from a specified role., run:

aws iam detach-role-policy --role-name ROLE-NAME --policy-arn POLICY-ARN

References

1. https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies
2. https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-delete.html
3. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/detach-user-policy.html
4. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/detach-group-policy.html
5. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/detach-role-policy.html

IAM Policy

You manage access in AWS by creating policies and attaching them to IAM identities or AWS resources. A policy is an object in AWS that, when associated with an entity or resource, defines their permissions. AWS evaluates these policies when a principal, such as a user, makes a request. Permissions in the policies determine whether the request is allowed or denied. Most policies are stored in AWS as JSON documents.

Compliance Frameworks

• AWS CloudGuard Best Practices
• AWS CloudGuard S3 Bucket Security
• AWS CloudGuard SOC2 based on AICPA TSC 2017
• AWS HITRUST v11.0.0
• AWS LGPD regulation
• AWS MITRE ATT&CK Framework v11.3
• AWS NIST 800-53 Rev 5
• CloudGuard AWS Default Ruleset