> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Policies with NotAction in the Statements ### More Info: Policies with NotAction in Statements. ### Label Indicates that the policy has a statement using `NotAction` with an `Allow` effect. ### Risk Level Low ### Address Security ### Compliance Standards CBP ### Evaluation Criteria A policy is flagged when a statement uses the `NotAction` element combined with `Effect: Allow`. This means the policy allows all actions except the ones explicitly listed, which can unintentionally grant broad permissions. **References:** * [IAM NotAction element](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notaction.html) ### Triage and Remediation ### Remediation To remediate the misconfiguration of policies with NotAction in the statements in AWS IAM, follow these steps using the AWS Management Console: 1. Sign in to the AWS Management Console. 2. Open the IAM console. 3. In the navigation pane, click on "Policies". 4. Search for the policy that contains the "NotAction" statement. 5. Select the policy by clicking on its name. 6. In the policy summary page, click on the "Edit policy" button. 7. In the policy editor, locate the statement with the "NotAction" condition that needs to be remediated. 8. Remove the "NotAction" condition from the statement. 9. Review the remaining conditions and ensure they are correct and aligned with your intended permissions. 10. Click on the "Review policy" button to validate the changes. 11. Review the policy summary page to verify that there are no errors or warnings. 12. Click on the "Save changes" button to apply the remediation. Once the policy is saved, the misconfiguration of having "NotAction" in the statements will be resolved. It is recommended to thoroughly review the policy to ensure that the desired permissions are correctly defined and that the policy aligns with your security requirements. # To remediate the misconfiguration of policies with NotAction in the statements in AWS IAM using AWS CLI, follow these steps: 1. Identify the policies that contain NotAction in their statements. You can use the AWS CLI command `list-policies` to list all the policies in your AWS account. ```bash theme={null} aws iam list-policies ``` Note down the ARN or name of the policies that have NotAction in their statements. 2. Retrieve the policy document for each identified policy using the AWS CLI command `get-policy-version`. Replace `` with the ARN of the policy you want to retrieve. ```bash theme={null} aws iam get-policy-version --policy-arn --version-id v1 ``` Note down the `Document` field value from the command output, as it contains the policy document. 3. Edit the policy document to remove the NotAction statement. You can use a text editor or a JSON editor to modify the policy document. Remove the `NotAction` field from each statement that contains it. For example, if the policy document looks like this: ```json theme={null} { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:*", "NotAction": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*" } ] } ``` Modify it to remove the `NotAction` field: ```json theme={null} { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:*", "Resource": "arn:aws:s3:::example-bucket/*" } ] } ``` 4. Once you have edited the policy document, save the changes. 5. Update the policy with the modified policy document using the AWS CLI command `create-policy-version`. Replace `` with the ARN of the policy you want to update, and `` with the path to the modified policy document JSON file. ```bash theme={null} aws iam create-policy-version --policy-arn --policy-document file:// --set-as-default ``` This command creates a new version of the policy with the modified policy document and sets it as the default version. 6. Verify that the policy has been updated by checking the policy version using the AWS CLI command `get-policy-version`. Replace `` with the ARN of the policy you updated. ```bash theme={null} aws iam get-policy-version --policy-arn --version-id v2 ``` Ensure that the `Document` field in the output matches the modified policy document. 7. Repeat steps 3-6 for each policy identified in step 1 that contains NotAction in its statements. By following these steps, you can remediate the misconfiguration of policies with NotAction in the statements in AWS IAM using AWS CLI. To remediate the issue of policies with NotAction in the statements in AWS IAM using Python, follow these steps: 1. Install the required dependencies: * Install the AWS SDK for Python (Boto3) using the command: `pip install boto3` 2. Configure your AWS credentials: * Open the AWS Management Console and go to the IAM service. * Create an IAM user with the necessary permissions to modify IAM policies. * Generate an access key and secret access key for the IAM user. * Configure your AWS credentials by running the command: `aws configure` and provide the access key, secret access key, and region. 3. Write a Python script to remediate the misconfigured policies. Below is an example script: ```python theme={null} import boto3 def remediate_policies(): # Create an IAM client iam_client = boto3.client('iam') # List all the policies in IAM response = iam_client.list_policies() # Iterate through each policy for policy in response['Policies']: # Get the policy details policy_arn = policy['Arn'] policy_version = iam_client.get_policy(PolicyArn=policy_arn)['Policy']['DefaultVersionId'] policy_document = iam_client.get_policy_version(PolicyArn=policy_arn, VersionId=policy_version)['PolicyVersion']['Document'] # Check if the policy contains a NotAction statement if 'NotAction' in policy_document['Statement']: # Remove the NotAction statement from the policy policy_document['Statement'].pop('NotAction') # Update the policy with the modified document iam_client.create_policy_version( PolicyArn=policy_arn, PolicyDocument=policy_document, SetAsDefault=True ) print(f"Policy {policy_arn} has been remediated.") remediate_policies() ``` 4. Run the Python script: * Save the script in a file, for example, `remediate_policies.py`. * Open a terminal or command prompt and navigate to the directory containing the script. * Run the command: `python remediate_policies.py`. The script will iterate through all the policies in your AWS account and remove the NotAction statement from any policies that contain it. The modified policies will be updated with the new version, replacing the old version.