IAM Policies Should Not Allow Full '*' Administrative Privileges Rule

IAM Policy Description: Restricting Administrative Privileges for PCI Compliance (PCI v3)

Rule/Policy:

Description:

Troubleshooting Steps:

2. 1.

   Identify IAM users or roles with full administrative privileges:

   • Review the IAM policies attached to users or roles in your AWS environment.
   • Look for policies that include the "*" wildcard character and provide full administrative access.
4. 2.

   Modify or revoke the affected IAM policies:

   • Create a new IAM policy with restrictions based on the principle of least privilege.
   • Attach the new policy to affected users or roles to limit their privileges to only necessary actions and resources.
   • If possible, split the administrative tasks into separate policies and assign them as necessary rather than granting full administrative access.
6. 3.

   Test and Validate:

   • Ensure that the modified policies do not cause any disruption to the necessary operations of the affected users or roles.
   • Verify that the restricted permissions are sufficient for their intended tasks.

Necessary Codes:

{
   "Version":"2012-10-17",
   "Statement":[{
      "Effect":"Allow",
      "Action":[
         "ec2:StartInstances",
         "ec2:StopInstances",
         "ec2:TerminateInstances"
      ],
      "Resource":"*"
   }]
}

Step-by-Step Guide for Remediation:

2. 1.

   Identify the affected IAM user(s) or role(s) that have full '*' administrative privileges.

4. 2.

   Create a new IAM policy or modify an existing policy based on the principle of least privilege. Use the provided IAM policy JSON example as a reference, and customize the required actions and resources for the affected user(s) or role(s).

6. 3.

   Sign in to the AWS Management Console and open the IAM console.

8. 4.

   Navigate to the "Policies" section.

10. 5.

    Create a new policy or select the existing policy that needs to be modified.

12. 6.

    Choose "JSON" as the policy editor and update the policy document with the necessary permissions based on the principle of least privilege.

14. 7.

    Validate the policy JSON for any syntax errors or incorrect permissions.

16. 8.

    Save the policy with a meaningful name that indicates its restricted permissions and purpose.

18. 9.

    Attach the newly created or modified policy to the affected IAM user(s) or role(s) while detaching the previous unrestricted policy.

20. 10.

    Perform thorough testing to ensure that the restricted permissions do not cause any disruptions while allowing the necessary operations for the user(s) or role(s).

22. 11.

    Monitor the affected IAM user(s) or role(s) to ensure compliance and periodically review their permissions to prevent any accidental privilege escalation.