Roles Should Not Have Permissions With Inline Policies

More Info:

Role should not have inline policies attached to them.

Risk Level

Low

Address

Security

Compliance Standards

APRA CPS 234 (Australia)
AWS Startup Security Baseline
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
DPDPA
Digital Operational Resilience Act (EU)
Essential 8
GDPR
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIS2 Directive
NIST
NIST SP 800-171
NYDFS 23 NYCRR 500
PCI
Reserve Bank of India (RBI) Master Direction – Information Technology Framework
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
UK NCSC Cyber Assessment Framework

Triage and Remediation

Prevention
Cause
Remediation

How to Prevent

Using Console

To prevent roles from having inline policies in AWS IAM using the AWS Management Console, follow these steps:

Navigate to IAM Dashboard:
- Sign in to the AWS Management Console.
- Open the IAM (Identity and Access Management) dashboard by selecting “IAM” from the services menu.
Review Existing Roles:
- In the IAM dashboard, select “Roles” from the left-hand navigation pane.
- Review the list of roles to identify any roles that have inline policies attached.
Remove Inline Policies:
- Click on the role name to view its details.
- In the “Permissions” tab, look for any inline policies listed under “Inline Policies.”
- For each inline policy, click on the policy name and then select “Delete” to remove the inline policy from the role.
Attach Managed Policies:
- Instead of using inline policies, attach managed policies to the role.
- In the role details, go to the “Permissions” tab and click “Attach policies.”
- Select the appropriate managed policies from the list and click “Attach policy” to apply them to the role.

By following these steps, you can ensure that roles do not have inline policies and instead use managed policies, which are easier to manage and audit.

Using CLI

To prevent roles from having inline policies in AWS IAM using the AWS CLI, you can follow these steps:

List All Roles: First, list all the IAM roles in your AWS account to identify which roles might have inline policies.
aws iam list-roles
Check for Inline Policies: For each role, check if there are any inline policies attached. Replace <role-name> with the actual role name.
aws iam list-role-policies --role-name <role-name>
Create Managed Policies: If you need to attach policies to roles, create managed policies instead of inline policies. This ensures that policies are reusable and easier to manage. Here is an example of creating a managed policy:
aws iam create-policy --policy-name MyManagedPolicy --policy-document file://policy.json
Attach Managed Policies to Roles: Attach the newly created managed policy to the role. Replace <role-name> with the actual role name and <policy-arn> with the ARN of the managed policy.
aws iam attach-role-policy --role-name <role-name> --policy-arn <policy-arn>

By following these steps, you can prevent roles from having inline policies and ensure that your IAM policies are managed more effectively.

Using Python

To prevent IAM roles from having inline policies in AWS using Python scripts, you can use the Boto3 library, which is the AWS SDK for Python. Here are the steps to achieve this:

Step 1: Install Boto3

First, ensure you have Boto3 installed. You can install it using pip if you haven’t already:

pip install boto3

Step 2: Initialize Boto3 Client

Initialize the Boto3 client for IAM:

import boto3

iam_client = boto3.client('iam')

Step 3: List All Roles

Fetch all IAM roles in your AWS account:

def list_roles():
    roles = []
    paginator = iam_client.get_paginator('list_roles')
    for page in paginator.paginate():
        roles.extend(page['Roles'])
    return roles

Step 4: Check and Remove Inline Policies

For each role, check if there are any inline policies and remove them if they exist:

def remove_inline_policies(role_name):
    inline_policies = iam_client.list_role_policies(RoleName=role_name)['PolicyNames']
    for policy_name in inline_policies:
        iam_client.delete_role_policy(RoleName=role_name, PolicyName=policy_name)
        print(f"Removed inline policy {policy_name} from role {role_name}")

def main():
    roles = list_roles()
    for role in roles:
        remove_inline_policies(role['RoleName'])

if __name__ == "__main__":
    main()

Summary

Install Boto3: Ensure Boto3 is installed in your Python environment.
Initialize Boto3 Client: Set up the IAM client using Boto3.
List All Roles: Retrieve all IAM roles in your AWS account.
Check and Remove Inline Policies: For each role, check for inline policies and remove them if they exist.

This script will help you prevent IAM roles from having inline policies by removing any existing inline policies. You can run this script periodically or integrate it into your CI/CD pipeline to ensure compliance.

Check Cause

Using Console

Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
In the navigation pane, choose “Roles”. This will display a list of all the IAM roles that are currently configured in your AWS environment.
Click on the name of the role that you want to inspect. This will open the summary page for the selected IAM role.
In the “Permissions” tab, look for the “Inline Policies” section. If there are any inline policies attached to the role, they will be listed here. If this section is empty, it means that the role does not have any inline policies, which is the recommended configuration.

Using CLI

First, you need to install and configure AWS CLI on your local machine. You can do this by following the instructions provided by AWS. Once you have AWS CLI installed and configured, you can start using it to interact with AWS services.
To list all the IAM roles in your AWS account, use the following command:
aws iam list-roles
This command will return a JSON object that contains all the IAM roles in your AWS account.
To check if a role has inline policies, you can use the following command:
aws iam list-role-policies --role-name {role-name}
Replace {role-name} with the name of the role you want to check. This command will return a list of all inline policies attached to the specified role. If the list is empty, it means that the role does not have any inline policies.
Repeat step 3 for each role in your AWS account. If any role has inline policies, it means that there is a misconfiguration.

Using Python

First, you need to install the AWS SDK for Python (Boto3) if you haven’t done so already. You can install it using pip:

pip install boto3

Import the necessary modules and create a session using your AWS credentials:

import boto3

session = boto3.Session(
    aws_access_key_id='YOUR_ACCESS_KEY',
    aws_secret_access_key='YOUR_SECRET_KEY',
    aws_session_token='SESSION_TOKEN',
)

Now, you can use the IAM client to list all the roles and their inline policies:

iam = session.client('iam')

paginator = iam.get_paginator('list_roles')
for response in paginator.paginate():
    for role in response['Roles']:
        inline_policies = iam.list_role_policies(RoleName=role['RoleName'])['PolicyNames']
        if inline_policies:
            print(f"Role {role['RoleName']} has inline policies: {inline_policies}")

This script will print out the names of all roles that have inline policies. If you want to see the details of these policies, you can use the get_role_policy method:

for policy in inline_policies:
    policy_details = iam.get_role_policy(RoleName=role['RoleName'], PolicyName=policy)
    print(policy_details)

This script will print out the details of all inline policies attached to the roles.

Remediation

Using Console

To remediate the “Roles Should Not Have Inline Policies” misconfiguration in AWS using the AWS Console, please follow these steps:

Log in to the AWS Management Console.
Open the IAM console.
In the navigation pane, choose “Roles”.
Select the role that has an inline policy attached to it.
Choose the “Permissions” tab.
Scroll down to the “Inline Policies” section.
Click on the inline policy that you want to remove.
Choose “Delete Policy”.
Confirm that you want to delete the policy by clicking on “Delete”.
Repeat steps 7-9 for all inline policies attached to the role.
After all inline policies have been removed, click on the “Policies” tab.
Click on “Create Policy”.
Choose “Create Your Own Policy”.
Enter a name for the policy and a description (optional).
In the “Policy Document” section, enter the policy JSON code that defines the permissions for the role.
Click on “Create Policy”.
Go back to the “Roles” page and select the role that you just created the policy for.
Choose the “Permissions” tab.
Click on “Attach Policies”.
Select the policy that you just created and click on “Attach Policy”.
Verify that the role no longer has any inline policies attached to it and that it has a policy attached to it via the “Policies” tab.

Congratulations! You have successfully remediated the “Roles Should Not Have Inline Policies” misconfiguration in AWS.

Using CLI

To remediate the issue “Roles Should Not Have Inline Policies” in AWS, you can follow these steps using AWS CLI:

List all the IAM roles in your AWS account using the following command:

aws iam list-roles

For each role, check if it has any inline policies attached to it using the following command:

aws iam list-role-policies --role-name <ROLE_NAME>

If the above command returns any inline policies, create a managed policy for the same using the following command:

aws iam create-policy --policy-name <POLICY_NAME> --policy-document file://<POLICY_DOCUMENT_FILE_PATH>

Note: Replace <POLICY_NAME> with a suitable name for the policy and <POLICY_DOCUMENT_FILE_PATH> with the path to the JSON policy document.

Attach the newly created managed policy to the role using the following command:

aws iam attach-role-policy --role-name <ROLE_NAME> --policy-arn <POLICY_ARN>

Note: Replace <POLICY_ARN> with the ARN of the newly created managed policy and <ROLE_NAME> with the name of the role to which the policy needs to be attached.

Finally, remove the inline policy from the role using the following command:

aws iam delete-role-policy --role-name <ROLE_NAME> --policy-name <POLICY_NAME>

Note: Replace <POLICY_NAME> with the name of the inline policy and <ROLE_NAME> with the name of the role from which the policy needs to be removed.Repeat the above steps for all the roles that have inline policies attached to them to remediate the issue “Roles Should Not Have Inline Policies” in AWS.

Using Python

To remediate the “Roles Should Not Have Inline Policies” misconfiguration in AWS using Python, you can follow the below steps:

First, you need to identify the roles that have inline policies. You can achieve this by using the AWS SDK for Python (Boto3) and the IAM client. You can use the list_roles() method to list all the roles in your AWS account, and then use the get_role_policy() method to get the policies attached to each role. If the policy is inline, you can add it to a list of inline policies.

import boto3

iam = boto3.client('iam')

inline_policies = []

roles = iam.list_roles()['Roles']

for role in roles:
    policies = iam.list_role_policies(RoleName=role['RoleName'])['PolicyNames']
    for policy_name in policies:
        policy = iam.get_role_policy(RoleName=role['RoleName'], PolicyName=policy_name)
        if 'PolicyDocument' in policy and 'Version' in policy['PolicyDocument']:
            if policy['PolicyDocument']['Version'] == '2012-10-17':
                inline_policies.append(policy_name)

Once you have identified the roles with inline policies, you can remove them using the delete_role_policy() method. You can loop through the list of roles and policies and delete each inline policy.

for role in roles:
    for policy_name in inline_policies:
        try:
            iam.delete_role_policy(RoleName=role['RoleName'], PolicyName=policy_name)
            print(f"Inline policy {policy_name} removed from role {role['RoleName']}")
        except Exception as e:
            print(f"Error removing inline policy {policy_name} from role {role['RoleName']}: {e}")

Finally, you can verify that the inline policies have been removed by repeating step 1 and checking that the list of inline policies is empty.

inline_policies = []

for role in roles:
    policies = iam.list_role_policies(RoleName=role['RoleName'])['PolicyNames']
    for policy_name in policies:
        policy = iam.get_role_policy(RoleName=role['RoleName'], PolicyName=policy_name)
        if 'PolicyDocument' in policy and 'Version' in policy['PolicyDocument']:
            if policy['PolicyDocument']['Version'] == '2012-10-17':
                inline_policies.append(policy_name)

if not inline_policies:
    print("All inline policies have been removed from roles")
else:
    print(f"Inline policies still exist: {inline_policies}")

By following these steps, you can remediate the “Roles Should Not Have Inline Policies” misconfiguration in AWS using Python.

Using Terraform

# Replace INLINE policies on the role with a customer-managed policy and attachment.

# 1) Customer-managed policy created from the former inline policy document
resource "aws_iam_policy" "ROLE_CONVERTED_POLICY" {
  name        = "ROLE_NAME-ConvertedPolicy" # replace with a descriptive name
  description = "Converted inline policy for ROLE_NAME" # optional

  # Either paste the JSON, or use a data "aws_iam_policy_document" instead.
  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    /* ORIGINAL_INLINE_POLICY_STATEMENTS_GO_HERE */
  ]
}
POLICY
}

# 2) Attach the new managed policy to the role
resource "aws_iam_role_policy_attachment" "ROLE_CONVERTED_POLICY_ATTACHMENT" {
  role       = aws_iam_role.ROLE_NAME.name
  policy_arn = aws_iam_policy.ROLE_CONVERTED_POLICY.arn
}

# 3a) If the inline policy was defined inline on the role, REMOVE it from this block.
resource "aws_iam_role" "ROLE_NAME" {
  name = "ROLE_NAME" # replace with your actual role name

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    /* TRUST_POLICY_STATEMENTS */
  ]
}
POLICY

  # IMPORTANT: delete any inline_policy blocks like this from your config:
  # inline_policy {
  #   name   = "INLINE_POLICY_NAME"
  #   policy = <<POLICY
  #   { ...inline policy JSON... }
  #   POLICY
  # }
}

# 3b) If the inline policy was managed via a separate aws_iam_role_policy resource,
#     remove that resource from your configuration instead of the inline block above:
#
# resource "aws_iam_role_policy" "ROLE_INLINE_POLICY" {
#   role   = aws_iam_role.ROLE_NAME.id
#   name   = "INLINE_POLICY_NAME"
#   policy = <<POLICY
#   { ...inline policy JSON... }
#   POLICY
# }
# (Delete this whole resource from your Terraform once the aws_iam_policy
#  and aws_iam_role_policy_attachment above are in place.)

This change does not force replacement of the IAM role itself; it only replaces the way permissions are attached (inline → managed policy). Apply in two stages if you need to verify access: first add aws_iam_policy and aws_iam_role_policy_attachment, confirm behavior, then remove the inline policy resource/block.Verification: terraform plan should show:

aws_iam_policy.ROLE_CONVERTED_POLICY to be created,
aws_iam_role_policy_attachment.ROLE_CONVERTED_POLICY_ATTACHMENT to be created,
and the previous inline policy definition (inline_policy block on aws_iam_role or aws_iam_role_policy resource) to be destroyed.

Additional Reading:

https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Roles Should Not Have Permissions With Inline Policies

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

How to Prevent

Step 1: Install Boto3

Step 2: Initialize Boto3 Client

Step 3: List All Roles

Step 4: Check and Remove Inline Policies

Summary

Check Cause

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​How to Prevent

​Step 1: Install Boto3

​Step 2: Initialize Boto3 Client

​Step 3: List All Roles

​Step 4: Check and Remove Inline Policies

​Summary

​Check Cause

​Remediation

​

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

How to Prevent

Step 1: Install Boto3

Step 2: Initialize Boto3 Client

Step 3: List All Roles

Step 4: Check and Remove Inline Policies

Summary

Check Cause

Remediation

Additional Reading: