More Info:
Giving permissions to resource: * (all resources) should be avoided or minimized in majority of the cases.Risk Level
MediumAddress
SecurityCompliance Standards
CISGCP,HIPAA,SCO2,NISTCSF,NIST,AWSWAF,ISO27001,HITRUST,CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of granting permission for all resources in AWS IAM Deep Dive, follow these steps using the AWS Management Console:
- Sign in to the AWS Management Console.
- Open the IAM console.
- In the navigation pane, choose “Policies”.
- Search for the policy that grants permission for all resources. This policy may have a wildcard (*) in the resource section, allowing access to all resources.
- Select the policy by clicking on its name.
- In the policy summary page, click on the “Edit policy” button.
- Review the policy document to ensure that it is the one granting permission for all resources. Make a note of the policy document for reference.
- Click on the “Delete policy version” button to delete the existing policy version.
- Confirm the deletion by clicking on the “Delete” button.
- Create a new policy version by clicking on the “Create version” button.
- In the policy version editor, modify the policy document to restrict access to specific resources or resource types. Remove any wildcard (*) entries.
- Review the modified policy document to ensure that it grants permission only to the required resources.
- Click on the “Review policy” button to validate the policy.
- Review the policy summary and verify that it grants permission to the intended resources.
- Click on the “Save changes” button to save the new policy version.
- In the policy summary page, click on the “Set as default version” button to make the new policy version the default.
- Confirm the action by clicking on the “Yes, set as default” button.
- Verify that the policy is now updated and grants permission only to the specified resources.
Using CLI
Using CLI
To remediate the misconfiguration of granting permission for all resources in AWS IAM using AWS CLI, follow these steps:
- Open the AWS CLI on your local machine or use the AWS CLI in the AWS Management Console.
-
Identify the user, group, or role that has been granted permission for all resources. You can use the following command to list all the policies attached to a user, group, or role:
- Once you have identified the policy that grants permission for all resources, note down the policy name.
-
Next, retrieve the policy document for the identified policy using the following command:
Replace
<policy-arn>with the ARN of the policy and<version-id>with the version ID of the policy document. - The command output will provide you with the JSON representation of the policy document. Copy the policy document to a text editor for editing.
-
In the policy document, locate the section where it grants permission for all resources. It might look similar to this:
-
Modify the policy document to specify the specific resources for which the permission should be granted. Replace the
"Resource": "*"with the appropriate resource ARNs or resource identifiers. For example:Ensure that you specify the correct ARN or identifier for the specific resource you want to grant permission to. - Save the modified policy document.
-
Finally, update the policy version with the modified policy document using the following command:
Replace
<policy-arn>with the ARN of the policy and<path-to-modified-policy-document>with the local file path to the modified policy document. -
After successfully creating the new policy version, you need to set it as the default version for the policy using the following command:
Replace
<policy-arn>with the ARN of the policy and<new-version-id>with the version ID of the newly created policy version. -
Verify that the policy has been updated by listing the attached policies again:
Ensure that the policy now grants permission only for the specified resources and not all resources.
Using Python
Using Python
To remediate the misconfiguration of granting permissions for all resources in AWS IAM, follow these steps using Python:
- Install the AWS SDK for Python (Boto3) if you haven’t already:
- Create a Python script and import the necessary libraries:
- Initialize the AWS IAM client:
- Retrieve a list of all IAM roles:
- Iterate through each role and remove the permissions for all resources:
- Save and run the Python script. It will iterate through all IAM roles and remove the permissions for all resources.
'AmazonEC2FullAccess' with the actual policy name that grants permissions for all resources. Repeat steps 5 and 6 for each policy that needs to be removed.Make sure you have the necessary permissions to modify IAM roles and policies before running the script.