AWS Account Should Have A Minimum Number of Admins

More Info:

Your AWS account should have minimum number of admins

Risk Level

Medium

Address

Security

Compliance Standards

APRA CPS 234 (Australia)
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
Cloudanix Best Practice
DPDPA
Digital Operational Resilience Act (EU)
Essential 8
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIS2 Directive
NIST SP 800-171
NYDFS 23 NYCRR 500
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
UK NCSC Cyber Assessment Framework

Triage and Remediation

Prevention
Cause
Remediation

How to Prevent

Using Console

To prevent having fewer than the minimum number of administrators in AWS IAM using the AWS Management Console, follow these steps:

Access IAM Dashboard:
- Sign in to the AWS Management Console.
- Navigate to the IAM (Identity and Access Management) service by searching for “IAM” in the search bar and selecting it.
Review IAM Users:
- In the IAM Dashboard, click on “Users” in the left-hand navigation pane.
- Review the list of users to identify those with administrative privileges. Look for users with the AdministratorAccess policy attached.
Check Group Memberships:
- Click on “Groups” in the left-hand navigation pane.
- Review the groups to see if any have the AdministratorAccess policy attached.
- Ensure that there are enough users in these groups to meet your minimum requirement for administrators.
Add Additional Admins if Necessary:
- If you find that you do not have the minimum number of administrators, you can add more users with administrative privileges.
- Click on “Add user” in the IAM Dashboard.
- Follow the prompts to create a new user and attach the AdministratorAccess policy to their account.

By following these steps, you can ensure that your AWS account maintains the minimum number of administrators required for proper management and security.

Using CLI

To prevent having fewer than the minimum required number of IAM administrators in an AWS account using the AWS CLI, you can follow these steps:

List Current IAM Users with Admin Access: Use the following command to list all IAM users and their attached policies. This helps identify users with administrative privileges.
aws iam list-users
Check Attached Policies for Admin Access: For each user, check their attached policies to see if they have administrative access. The following command lists the policies attached to a specific user:
aws iam list-attached-user-policies --user-name <user-name>
Look for policies like AdministratorAccess.
Create New IAM Admin User (if needed): If you find that the number of admin users is below the required minimum, create a new IAM user and attach the AdministratorAccess policy. First, create the user:
aws iam create-user --user-name <new-admin-user>
Then attach the AdministratorAccess policy:
aws iam attach-user-policy --user-name <new-admin-user> --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

Automate Monitoring with a Script: To ensure continuous compliance, you can write a script that periodically checks the number of admin users and alerts you if it falls below the minimum threshold. Here is a simple example in Python:

import boto3

def check_admin_users(min_admins=2):
    iam = boto3.client('iam')
    users = iam.list_users()['Users']
    admin_count = 0

    for user in users:
        policies = iam.list_attached_user_policies(UserName=user['UserName'])['AttachedPolicies']
        for policy in policies:
            if policy['PolicyArn'] == 'arn:aws:iam::aws:policy/AdministratorAccess':
                admin_count += 1
                break

    if admin_count < min_admins:
        print(f"Warning: Only {admin_count} admin users found. Minimum required is {min_admins}.")

check_admin_users()

By following these steps, you can ensure that your AWS account maintains the required minimum number of IAM administrators.

Using Python

To prevent having fewer than the minimum required number of administrators in AWS IAM using Python scripts, you can follow these steps:

Set Up AWS SDK for Python (Boto3):
- Ensure you have Boto3 installed. If not, install it using pip:
  pip install boto3
Define the Minimum Number of Admins:
- Set a variable to define the minimum number of administrators required in your AWS account.
List IAM Users and Check for Admins:
- Use Boto3 to list all IAM users and check their attached policies to determine if they have administrative privileges.
Automate the Monitoring and Notification:
- Create a script that runs periodically to check the number of admins and sends a notification if the number falls below the minimum threshold.

Here is a sample Python script to achieve this:

import boto3
from botocore.exceptions import NoCredentialsError, PartialCredentialsError

# Define the minimum number of admins required
MIN_ADMINS = 2

def get_iam_users():
    try:
        iam_client = boto3.client('iam')
        paginator = iam_client.get_paginator('list_users')
        users = []
        for response in paginator.paginate():
            users.extend(response['Users'])
        return users
    except (NoCredentialsError, PartialCredentialsError) as e:
        print(f"Error: {e}")
        return []

def is_admin(user_name):
    try:
        iam_client = boto3.client('iam')
        attached_policies = iam_client.list_attached_user_policies(UserName=user_name)['AttachedPolicies']
        for policy in attached_policies:
            if policy['PolicyName'] == 'AdministratorAccess':
                return True
        return False
    except Exception as e:
        print(f"Error checking admin status for {user_name}: {e}")
        return False

def check_admins():
    users = get_iam_users()
    admin_count = 0
    for user in users:
        if is_admin(user['UserName']):
            admin_count += 1
    return admin_count

def main():
    admin_count = check_admins()
    if admin_count < MIN_ADMINS:
        print(f"Warning: The number of admins ({admin_count}) is below the minimum required ({MIN_ADMINS}).")
        # Here you can add code to send a notification (e.g., email, SNS, etc.)

if __name__ == "__main__":
    main()

Explanation:

Set Up AWS SDK for Python (Boto3):
- The script starts by importing the necessary libraries and setting up the Boto3 client to interact with AWS IAM.
Define the Minimum Number of Admins:
- The MIN_ADMINS variable is set to the minimum number of administrators required.
List IAM Users and Check for Admins:
- The get_iam_users function retrieves all IAM users.
- The is_admin function checks if a user has the AdministratorAccess policy attached.
- The check_admins function counts the number of users with administrative privileges.
Automate the Monitoring and Notification:
- The main function checks the number of admins and prints a warning if the count is below the minimum required. You can extend this function to send notifications via email, SNS, or other methods.

By running this script periodically (e.g., as a scheduled Lambda function or a cron job), you can ensure that your AWS account always has the required minimum number of administrators.

Check Cause

Using Console

Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
In the navigation pane, choose “Users”. This will display a list of all IAM users that are currently set up for your AWS account.
For each user, check the “Permissions” tab to see what policies are attached to the user. Look for policies that grant administrator privileges, such as “AdministratorAccess”.
Count the number of users with administrator privileges. If the number is less than the minimum number of admins you have set as a standard for your organization, then it is a misconfiguration.

Using CLI

Install and configure AWS CLI: Before you can start using AWS CLI, you need to install it on your local machine and configure it with your AWS account credentials. You can do this by running the following commands: Installation:
pip install awscli
Configuration:
aws configure
You will be prompted to provide your AWS Access Key ID, Secret Access Key, Default region name, and Default output format.
List IAM Users: Once AWS CLI is set up, you can list all the IAM users in your AWS account by running the following command:
aws iam list-users
This command will return a list of all IAM users along with their details.
List IAM Policies: For each user, you can list the policies attached to them. This can be done using the following command:
aws iam list-user-policies --user-name <username>
Replace <username> with the name of the user. This command will return a list of all policy names attached to the specified user.
Check for Admin Policies: Finally, you can check if the user has ‘AdministratorAccess’ policy attached. This policy provides full access to AWS services and resources. If the number of users with this policy is less than the minimum required, it indicates a misconfiguration. You can do this by checking if ‘AdministratorAccess’ is present in the list of policies returned in the previous step.

Using Python

Install the necessary AWS SDK for Python (Boto3) if you haven’t done so already. You can install it using pip:

pip install boto3

Import the necessary modules and create a session using your AWS credentials:

import boto3

session = boto3.Session(
    aws_access_key_id='YOUR_ACCESS_KEY',
    aws_secret_access_key='YOUR_SECRET_KEY',
    region_name='YOUR_REGION'
)

Use the IAM client from Boto3 to list all the IAM users in your AWS account:

iam = session.client('iam')

users = iam.list_users()['Users']

Iterate over the users and check their policies. If a user has the ‘AdministratorAccess’ policy, increment a counter. If the counter is less than the minimum number of admins you want, raise an alert:

admin_count = 0
for user in users:
    policies = iam.list_attached_user_policies(UserName=user['UserName'])['AttachedPolicies']
    for policy in policies:
        if policy['PolicyName'] == 'AdministratorAccess':
            admin_count += 1

if admin_count < MIN_ADMINS:
    print(f'Alert: Only {admin_count} admins in the account. Minimum required is {MIN_ADMINS}.')

Replace ‘YOUR_ACCESS_KEY’, ‘YOUR_SECRET_KEY’, ‘YOUR_REGION’, and ‘MIN_ADMINS’ with your actual AWS access key, secret key, region, and the minimum number of admins you want in your AWS account, respectively.

Remediation

Using Console

Step-by-step instructions to remediate the AWS misconfiguration of having a minimum number of admins:

Log in to your AWS console with your credentials.
Navigate to the “IAM” (Identity and Access Management) service from the AWS console dashboard.
Click on the “Users” option from the left-hand side menu.
Identify the users who have been assigned the “AdministratorAccess” policy. These users have full access to your AWS account and should be limited to a minimum number.
Remove the “AdministratorAccess” policy from any user who does not require full access to the AWS account. To do this, select the user and click on the “Permissions” tab. Then click on the “Detach Policy” button next to the “AdministratorAccess” policy.
Create a new IAM group with the necessary permissions for users who require access to the AWS account. To create a new group, click on the “Groups” option from the left-hand side menu and then click on the “Create New Group” button. Give the group a name and attach the necessary policies.
Add the required users to the new group. To do this, select the group and click on the “Add Users to Group” button. Select the users you want to add and click on the “Add Users” button.
Ensure that you have a minimum number of users assigned the “AdministratorAccess” policy. This number will depend on your organization’s security policies and requirements.

By following these steps, you can remediate the AWS misconfiguration of having a minimum number of admins.

Using CLI

The misconfiguration in this case is that there are too many AWS Admins in the account. To remediate this issue, follow these steps using AWS CLI:

Identify the number of AWS Admins in your account by running the following command:

aws iam list-users --query 'Users[?contains(PermissionsBoundary.PermissionsBoundaryType, `PermissionsBoundary`) && contains(PermissionsBoundary.PermissionsBoundaryArn, `arn:aws:iam::aws:policy/AdministratorAccess`)].UserName' --output text | wc -l

Set the maximum number of AWS Admins that should be allowed in your account. For example, if you want to limit the number of AWS Admins to 5, set the maximum number to 5.

Identify the AWS Admin users who should be removed from the account by running the following command:

aws iam list-users --query 'Users[?contains(PermissionsBoundary.PermissionsBoundaryType, `PermissionsBoundary`) && contains(PermissionsBoundary.PermissionsBoundaryArn, `arn:aws:iam::aws:policy/AdministratorAccess`)].UserName' --output text | head -n $(($(aws iam list-users --query 'length(Users[?contains(PermissionsBoundary.PermissionsBoundaryType, `PermissionsBoundary`) && contains(PermissionsBoundary.PermissionsBoundaryArn, `arn:aws:iam::aws:policy/AdministratorAccess`)].UserName)' --output text)-5)) | xargs -I {} aws iam detach-user-policy --user-name {} --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

This command lists all the AWS Admin users who have the AdministratorAccess policy attached to them and removes the AdministratorAccess policy from the users who exceed the maximum number of allowed AWS Admins.

Verify that the number of AWS Admins has been reduced to the maximum allowed by running the command in step 1 again.

By following these steps, you can remediate the misconfiguration of having too many AWS Admins in your account.

Using Python

To remediate the AWS misconfiguration of having a minimum number of admins, you can use the following steps in Python:

First, you need to determine the number of admins in your AWS account. You can use the AWS SDK for Python (boto3) to retrieve the list of IAM users with the “AdministratorAccess” policy attached to their account.

import boto3

client = boto3.client('iam')

admins = []

response = client.list_users()

for user in response['Users']:
    user_policies = client.list_attached_user_policies(UserName=user['UserName'])
    for policy in user_policies['AttachedPolicies']:
        if policy['PolicyName'] == 'AdministratorAccess':
            admins.append(user['UserName'])

Once you have the list of admins, you can check if the number of admins meets the minimum requirement. If it does not, you can create a new IAM user with the “AdministratorAccess” policy attached to their account.

if len(admins) < MINIMUM_ADMINS:
    new_admin = client.create_user(UserName='new_admin')
    client.attach_user_policy(UserName=new_admin['User']['UserName'], PolicyArn='arn:aws:iam::aws:policy/AdministratorAccess')

Finally, you can send a notification to the relevant stakeholders informing them of the new admin account and reminding them of the minimum admin requirement.

sns = boto3.client('sns')

message = f"A new admin account has been created for the AWS account. Please ensure that the minimum number of admins ({MINIMUM_ADMINS}) is maintained."
sns.publish(TopicArn='arn:aws:sns:us-east-1:123456789012:aws-account-notifications', Message=message)

Note: Replace MINIMUM_ADMINS and arn:aws:sns:us-east-1:123456789012:aws-account-notifications with the actual values for your AWS account.

Using Terraform

# Example: IAM user WITHOUT administrative permissions

# IAM user
resource "aws_iam_user" "NON_ADMIN_USER" {
  name = "NON_ADMIN_USER_NAME" # replace with the IAM user name
}

# (1) DETACH ADMINISTRATIVE MANAGED POLICY FROM USER
# If this resource currently exists in your code attaching admin policies,
# REMOVE or CHANGE it so the admin policy is no longer attached.

# Before (undesired):
# resource "aws_iam_user_policy_attachment" "admin_to_user" {
#   user       = aws_iam_user.NON_ADMIN_USER.name
#   policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
# }

# After (no attachment) – simply delete the attachment resource from Terraform.
# Terraform plan should show: "Destroy" aws_iam_user_policy_attachment.admin_to_user.


# (2) REMOVE USER FROM ADMINISTRATIVE GROUPS
# If the user is a member of an admin group via Terraform, REMOVE that membership.

# Example admin group
resource "aws_iam_group" "ADMIN_GROUP" {
  name = "ADMIN_GROUP_NAME" # replace with the IAM group name that has admin rights
}

# Before (undesired membership):
# resource "aws_iam_group_membership" "user_in_admin_group" {
#   name  = "user-in-admin-group"
#   users = [aws_iam_user.NON_ADMIN_USER.name]
#   group = aws_iam_group.ADMIN_GROUP.name
# }

# After – remove this membership resource from your config
# or ensure NON_ADMIN_USER is not listed in its `users` argument.
# Terraform plan should show: "Destroy" aws_iam_group_membership.user_in_admin_group
# or a change to the `users` list that omits NON_ADMIN_USER.


# (3) DELETE ADMINISTRATIVE INLINE POLICY ON USER
# If the user has an inline policy granting admin (`*:*`), REMOVE that resource.

# Before (example of an overly permissive inline policy):
# resource "aws_iam_user_policy" "user_admin_inline" {
#   name = "INLINE_POLICY_NAME_TO_DELETE" # replace with the actual inline policy name
#   user = aws_iam_user.NON_ADMIN_USER.name
#
#   policy = jsonencode({
#     Version = "2012-10-17"
#     Statement = [
#       {
#         Effect   = "Allow"
#         Action   = "*"
#         Resource = "*"
#       }
#     ]
#   })
# }

# After – delete the aws_iam_user_policy.user_admin_inline resource
# from Terraform so the inline policy is removed.
# WARNING: Deleting an inline policy is a destructive action and cannot be undone.
# Terraform plan should show: "Destroy" aws_iam_user_policy.user_admin_inline.


# (4) OPTIONAL: ATTACH A RESTRICTED, NON-ADMIN POLICY INSTEAD
# Example of replacing admin access with a limited policy.

data "aws_iam_policy_document" "NON_ADMIN_USER_POLICY_DOC" {
  statement {
    effect = "Allow"

    actions = [
      "s3:GetObject",
      "s3:ListBucket",
    ]

    resources = [
      "arn:aws:s3:::SPECIFIC_BUCKET_NAME",       # replace with allowed bucket
      "arn:aws:s3:::SPECIFIC_BUCKET_NAME/*",    # replace with allowed bucket
    ]
  }
}

resource "aws_iam_user_policy" "non_admin_inline" {
  name   = "NON_ADMIN_INLINE_POLICY_NAME" # give a descriptive name
  user   = aws_iam_user.NON_ADMIN_USER.name
  policy = data.aws_iam_policy_document.NON_ADMIN_USER_POLICY_DOC.json
}

Removing policy attachments, group memberships, or inline policies for the user may affect applications or users relying on those admin privileges; apply only after validating impact.For verification, terraform plan should show:

Destroy for any aws_iam_user_policy_attachment that was attaching admin policies to the user.
Destroy or an update to any aws_iam_group_membership so the user is no longer in admin groups.
Destroy for any aws_iam_user_policy resources that granted administrative (*:*) permissions.
Optionally, Create or Update for a new restricted aws_iam_user_policy if you added one.

Additional Reading:

https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

AWS Account Should Have A Minimum Number of Admins

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

How to Prevent

Explanation:

Check Cause

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​How to Prevent

​Explanation:

​Check Cause

​Remediation

​

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

How to Prevent

Explanation:

Check Cause

Remediation

Additional Reading: