CreateGroup

​

Event Information

• The CreateGroup event in AWS for IAM refers to the action of creating a new IAM group.
• IAM groups are used to manage permissions for multiple users, allowing you to assign policies to a group instead of individual users.
• When the CreateGroup event occurs, it means that a new IAM group has been successfully created in AWS, and you can further configure the group’s permissions and policies.

​

Examples

• Unauthorized access: If the CreateGroup operation in AWS Identity and Access Management (IAM) is not properly secured, it can lead to unauthorized users being able to create new groups and gain access to resources they should not have access to. This can result in data breaches and compromise the security of the system.

• Privilege escalation: If the CreateGroup operation is not properly restricted, it can be abused by malicious users to escalate their privileges within the system. They can create new groups with higher levels of access and use them to gain unauthorized access to sensitive resources.

• Resource depletion: If the CreateGroup operation is not properly controlled, it can be used to create a large number of unnecessary groups, leading to resource depletion. This can impact the performance and availability of the IAM service and other dependent services.

​

Remediation

​

Using Console

1. Example 1: Enforce strong password policy for IAM users

   • Step 1: Login to the AWS Management Console.
   • Step 2: Go to the IAM service.
   • Step 3: Click on “Account settings” in the left navigation pane.
   • Step 4: Under the “Password policy” section, click on “Edit”.
   • Step 5: Enable the “Require at least one uppercase letter” option.
   • Step 6: Enable the “Require at least one lowercase letter” option.
   • Step 7: Enable the “Require at least one number” option.
   • Step 8: Enable the “Require at least one non-alphanumeric character” option.
   • Step 9: Set the “Minimum password length” to an appropriate value.
   • Step 10: Click on “Apply password policy”.

2. Example 2: Enable multi-factor authentication (MFA) for IAM users

   • Step 1: Login to the AWS Management Console.
   • Step 2: Go to the IAM service.
   • Step 3: Click on “Users” in the left navigation pane.
   • Step 4: Select the IAM user for which you want to enable MFA.
   • Step 5: Click on the “Security credentials” tab.
   • Step 6: Under the “Multi-factor authentication (MFA)” section, click on “Manage”.
   • Step 7: Click on “Activate MFA”.
   • Step 8: Choose the appropriate MFA device option (e.g., virtual MFA device, hardware MFA device).
   • Step 9: Follow the on-screen instructions to complete the MFA setup.

3. Example 3: Enable AWS CloudTrail for logging IAM events

   • Step 1: Login to the AWS Management Console.
   • Step 2: Go to the CloudTrail service.
   • Step 3: Click on “Trails” in the left navigation pane.
   • Step 4: Click on “Create trail”.
   • Step 5: Provide a name for the trail and choose the appropriate settings (e.g., log file storage location, log file encryption).
   • Step 6: Under the “Management events” section, enable logging for IAM events.
   • Step 7: Click on “Create”.

Note: The above steps are general guidelines and may vary slightly based on the AWS Management Console interface. Always refer to the official AWS documentation for the most up-to-date instructions.

​

Using CLI

1. Ensure IAM users have strong passwords:

   • Use the update-login-profile command to set a strong password for an IAM user:

     aws iam update-login-profile --user-name <IAM_USER_NAME> --password <NEW_PASSWORD> --password-reset-required
     

2. Enable multi-factor authentication (MFA) for IAM users:

   • Use the enable-mfa-device command to enable MFA for an IAM user:

     aws iam enable-mfa-device --user-name <IAM_USER_NAME> --serial-number <MFA_DEVICE_SERIAL_NUMBER> --authentication-code1 <CODE1> --authentication-code2 <CODE2>
     

3. Remove unnecessary IAM access keys:

   • Use the delete-access-key command to delete an IAM access key:

     aws iam delete-access-key --user-name <IAM_USER_NAME> --access-key-id <ACCESS_KEY_ID>
     

​

Using Python

1. Ensure IAM users have strong passwords:

   • Use the boto3 library in Python to retrieve a list of IAM users.
   • For each user, check if their password meets the desired complexity requirements (e.g., minimum length, use of uppercase, lowercase, numbers, and special characters).
   • If a user’s password does not meet the requirements, use the update_login_profile method to update the user’s password with a randomly generated strong password.

   import boto3
   import string
   import random
   
   def generate_password(length=12):
       characters = string.ascii_letters + string.digits + string.punctuation
       return ''.join(random.choice(characters) for _ in range(length))
   
   def remediate_weak_passwords():
       iam_client = boto3.client('iam')
       users = iam_client.list_users()['Users']
       for user in users:
           if not is_password_strong(user['UserName']):
               new_password = generate_password()
               iam_client.update_login_profile(
                   UserName=user['UserName'],
                   Password=new_password,
                   PasswordResetRequired=True
               )
               print(f"Updated password for user {user['UserName']}")
   
   remediate_weak_passwords()
   

2. Enable multi-factor authentication (MFA) for IAM users:

   • Use the boto3 library in Python to retrieve a list of IAM users.
   • For each user, check if MFA is already enabled. If not, use the enable_mfa method to enable MFA for the user.

   import boto3
   
   def enable_mfa_for_users():
       iam_client = boto3.client('iam')
       users = iam_client.list_users()['Users']
       for user in users:
           mfa_devices = iam_client.list_mfa_devices(UserName=user['UserName'])['MFADevices']
           if not mfa_devices:
               iam_client.enable_mfa(
                   UserName=user['UserName'],
                   SerialNumber='arn:aws:iam::123456789012:mfa/user',
                   AuthenticationCode1='123456',
                   AuthenticationCode2='789012'
               )
               print(f"Enabled MFA for user {user['UserName']}")
   
   enable_mfa_for_users()
   

3. Remove unused IAM access keys:

   • Use the boto3 library in Python to retrieve a list of IAM users.
   • For each user, check if they have any access keys that are not used recently.
   • If an access key is not used recently, use the delete_access_key method to delete the access key.

   import boto3
   from datetime import datetime, timedelta
   
   def remove_unused_access_keys():
       iam_client = boto3.client('iam')
       users = iam_client.list_users()['Users']
       for user in users:
           access_keys = iam_client.list_access_keys(UserName=user['UserName'])['AccessKeyMetadata']
           for access_key in access_keys:
               last_used = iam_client.get_access_key_last_used(AccessKeyId=access_key['AccessKeyId'])
               if 'LastUsedDate' in last_used and last_used['LastUsedDate'] < datetime.now() - timedelta(days=90):
                   iam_client.delete_access_key(
                       UserName=user['UserName'],
                       AccessKeyId=access_key['AccessKeyId']
                   )
                   print(f"Deleted unused access key {access_key['AccessKeyId']} for user {user['UserName']}")
   
   remove_unused_access_keys()