Ensure Managed IAM Policies: Blocked Actions on KMS Keys

Rule Description

Troubleshooting Steps

2. 1.
   Identify the IAM policy that allows the blocked actions on KMS keys.
4. 2.
   Review the permissions granted by the policy.
6. 3.
   Determine which actions are blocked based on the FedRAMP Low Revision 4 requirements.
8. 4.
   Modify the IAM policy to remove the blocked actions.
10. 5.
    Test the modified policy to ensure it now complies with the rule.
12. 6.
    Monitor and evaluate IAM policy changes regularly to maintain compliance.

Necessary Code

aws iam put-role-policy --role-name <role-name> --policy-name <policy-name> --policy-document file://policy.json

<role-name>

<policy-name>

policy.json

Step-by-Step Guide for Remediation

2. 1.

   Identify the IAM policy:

   • Log in to the AWS Management Console.
   • Go to the IAM service.
   • Navigate to the "Policies" section.
   • Search for the policy that needs to be updated.
4. 2.

   Review the permissions granted by the policy:

   • Open the identified policy for review.
   • Analyze the list of actions and resources specified in the policy document.
6. 3.

   Determine which actions are blocked:

   • Refer to the specific requirements outlined in the FedRAMP Low Revision 4 guidelines.
   • Identify the actions that are considered blocked for compliance.
8. 4.

   Modify the IAM policy:

   • Using the AWS CLI or AWS Management Console, open the identified IAM policy for editing.
   • Locate the blocked actions in the policy document.
   • Remove the blocked actions from the policy document.
   • Save the changes to the policy.
10. 5.

    Test the modified policy:

    • Create a test user or assign an existing user to the IAM role associated with the policy.
    • Validate that the user can no longer perform the blocked actions on KMS keys.
    • Perform additional testing to ensure that the necessary permissions are still intact.
12. 6.

    Monitor and evaluate IAM policy changes:

    • Regularly review and assess IAM policies to ensure ongoing compliance.
    • Establish a process to track and manage any modifications made to the policies.
    • Continuously monitor and evaluate the effectiveness of policy changes.