Guides

Ensure IAM user, group, or role do not have access to create or update login profiles (passwords) for IAM users

To prevent privilege escalation, you should use service control policies (SCPs) to prevent users in your accounts, except for IAM administrators or delegated admins, from using administrative IAM actions.

Suggest Edits

Risk Level: Low
Cloud Entity: IAM Policy
CloudGuard Rule ID: D9.AWS.IAM.84
Category: Security, Identity, & Compliance

GSL LOGIC

IamPolicy where attachmentCount >0 should not have document.Statement contain [ Effect='Allow' and (Action='iam:UpdateLoginProfile' or Action='iam:CreateLoginProfile') ]

REMEDIATION

Note: AWS managed policies cannot be deleted.

From Portal

  1. Go to 'IAM'
  2. In the menu, under 'Access management', choose 'Policies'
  3. For each incompliant policy, make sure there are no IAM entities attached to it:
  4. Choose the incompliant policy
  5. Under 'Policy usage', detach any IAM entity attached to it

From Command Line
To remove the specified managed policy from a specified user, run:

aws iam detach-user-policy --user-name USER-NAME --policy-arn POLICY-ARN

To remove the specified managed policy from a specified IAM group, run:

aws iam detach-group-policy --group-name GROUP-NAME --policy-arn POLICY-ARN

To remove the specified managed policy from a specified role., run:

aws iam detach-role-policy --role-name ROLE-NAME --policy-arn POLICY-ARN

References

  1. https://docs.aws.amazon.com/wellarchitected/latest/financial-services-industry-lens/aws-identity-and-access-management-iam.html
  2. https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html

IAM Policy

You manage access in AWS by creating policies and attaching them to IAM identities or AWS resources. A policy is an object in AWS that, when associated with an entity or resource, defines their permissions. AWS evaluates these policies when a principal, such as a user, makes a request. Permissions in the policies determine whether the request is allowed or denied. Most policies are stored in AWS as JSON documents.

Compliance Frameworks

  • AWS CloudGuard Best Practices
  • AWS CloudGuard SOC2 based on AICPA TSC 2017
  • AWS HITRUST v11.0.0
  • AWS MITRE ATT&CK Framework v11.3
  • AWS NIST 800-53 Rev 5

Updated over 1 year ago