Policies with NotAction in the Statements
More Info:
Policies with NotAction in Statements.Risk Level
LowAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of policies with NotAction in the statements in AWS IAM, follow these steps using the AWS Management Console:
- Sign in to the AWS Management Console.
- Open the IAM console.
- In the navigation pane, click on “Policies”.
- Search for the policy that contains the “NotAction” statement.
- Select the policy by clicking on its name.
- In the policy summary page, click on the “Edit policy” button.
- In the policy editor, locate the statement with the “NotAction” condition that needs to be remediated.
- Remove the “NotAction” condition from the statement.
- Review the remaining conditions and ensure they are correct and aligned with your intended permissions.
- Click on the “Review policy” button to validate the changes.
- Review the policy summary page to verify that there are no errors or warnings.
- Click on the “Save changes” button to apply the remediation.
Using CLI
Using CLI
To remediate the misconfiguration of policies with NotAction in the statements in AWS IAM using AWS CLI, follow these steps:
-
Identify the policies that contain NotAction in their statements. You can use the AWS CLI command
list-policiesto list all the policies in your AWS account.Note down the ARN or name of the policies that have NotAction in their statements. -
Retrieve the policy document for each identified policy using the AWS CLI command
get-policy-version. Replace<policy-arn>with the ARN of the policy you want to retrieve.Note down theDocumentfield value from the command output, as it contains the policy document. -
Edit the policy document to remove the NotAction statement. You can use a text editor or a JSON editor to modify the policy document. Remove the
NotActionfield from each statement that contains it. For example, if the policy document looks like this:Modify it to remove theNotActionfield: - Once you have edited the policy document, save the changes.
-
Update the policy with the modified policy document using the AWS CLI command
create-policy-version. Replace<policy-arn>with the ARN of the policy you want to update, and<modified-policy-document>with the path to the modified policy document JSON file.This command creates a new version of the policy with the modified policy document and sets it as the default version. -
Verify that the policy has been updated by checking the policy version using the AWS CLI command
get-policy-version. Replace<policy-arn>with the ARN of the policy you updated.Ensure that theDocumentfield in the output matches the modified policy document. - Repeat steps 3-6 for each policy identified in step 1 that contains NotAction in its statements.
Using Python
Using Python
To remediate the issue of policies with NotAction in the statements in AWS IAM using Python, follow these steps:
-
Install the required dependencies:
- Install the AWS SDK for Python (Boto3) using the command:
pip install boto3
- Install the AWS SDK for Python (Boto3) using the command:
-
Configure your AWS credentials:
- Open the AWS Management Console and go to the IAM service.
- Create an IAM user with the necessary permissions to modify IAM policies.
- Generate an access key and secret access key for the IAM user.
- Configure your AWS credentials by running the command:
aws configureand provide the access key, secret access key, and region.
- Write a Python script to remediate the misconfigured policies. Below is an example script:
- Run the Python script:
- Save the script in a file, for example,
remediate_policies.py. - Open a terminal or command prompt and navigate to the directory containing the script.
- Run the command:
python remediate_policies.py.
- Save the script in a file, for example,